Extracted

• • Target

    a3dea5adac1ef67cefa452276ca887be_JaffaCakes118

  • Size

    2.2MB

  • MD5

    a3dea5adac1ef67cefa452276ca887be

  • SHA1

    32a1b1f1e628afdb120a1a430338b21211c10cfb

  • SHA256

    014d5ee0b68aa666821c59d272849a0f7d80b56a8197526fd76fac54cd6e9c2e

  • SHA512

    b08542eabe20af9fe29a170c9e6fa109c5e01df99d083460c2d799c2d95f516cc0b9d89e1971a5a609e0b91d07fbd857a26da74e41def9f4d34aa4ee85efc30b

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwt

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2