Extracted

• • Target

    a96a1cc4f342419e4776d1f6176ac4ef_JaffaCakes118

  • Size

    2.2MB

  • MD5

    a96a1cc4f342419e4776d1f6176ac4ef

  • SHA1

    b7423ef89346b8e110e758e6591199284d8f6111

  • SHA256

    475b2d2baabfe4fbf33425c5e65266311c16a59c1838c81043c1caa113e07aa4

  • SHA512

    6055d8e92c0c1508742e4b120426916bf3a20049526e55a42842e507e74f57efb1f6b334809a123e6092ea83af8d6d0f990e45b05f044d5ea527e6b47ed0dce3

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ6:0UzeyQMS4DqodCnoe+iitjWww+

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2