Extracted

• • Target

    a4c4b76f4327e836aec65a6d56af2d28_JaffaCakes118

  • Size

    2.2MB

  • MD5

    a4c4b76f4327e836aec65a6d56af2d28

  • SHA1

    7d6e55c24f8b8dd9a3f32aa35420ff74ab379c77

  • SHA256

    438b54a414d27617058287dc2b2474cf5553cec2fc51ca8965609ea9003dba11

  • SHA512

    ba5b0153c4361800816937adba1acaaa44e5789b683e74c35609cbc0628909bd41d340bc81dcce42bc8451224619b7fa4cc92f1ff7a7566de297f3c4f3607e25

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZm:0UzeyQMS4DqodCnoe+iitjWwwi

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2