Extracted

• • Target

    a7adbc7c7c55be04406c29eb5f4702fa_JaffaCakes118

  • Size

    2.6MB

  • MD5

    a7adbc7c7c55be04406c29eb5f4702fa

  • SHA1

    0d9e25ada0e5791de763a14fdd35f60bbae0dd1b

  • SHA256

    71661e0c9b453d98097d4a30674b6003b36de1fe7db2c04f80618d3ee14016f6

  • SHA512

    933f6267335ecbf33655143aea033073e46f2615c4344d8984b5dd4a80266d8135a0846a58ef9e70ef705f49779242f327739b723383c521b1b3ae755f58ec45

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl4:86SIROiFJiwp0xlrl4

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2