Extracted

• • Target

    a84d68930ccf65fa12d349bfab110ae8_JaffaCakes118

  • Size

    2.2MB

  • MD5

    a84d68930ccf65fa12d349bfab110ae8

  • SHA1

    d0f2e8de0acc6a75d3929f3f6c88386009fe6eca

  • SHA256

    451dafd9e1245f42e984199b88fdaea35192f29d271c235200df7fe6a8317a23

  • SHA512

    2484c692eb69dc83802c907977f863f9ddc87421cc56f12bdf9ed11e7b05542aa0a4990a0242f5d2f686d4dce16f61358e7f87af6ef46fc6794f340fa5b4bd1a

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZL:0UzeyQMS4DqodCnoe+iitjWwwH

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2