Extracted

• • Target

    b04e189e8dbae6220669cdfd2df2cfdf_JaffaCakes118

  • Size

    2.6MB

  • MD5

    b04e189e8dbae6220669cdfd2df2cfdf

  • SHA1

    e8129f6bd5a11bbcd396374106e72103575c813e

  • SHA256

    fade87bac40edf1c2ba0913b91bc9aa7138b088847370c1fb700c8fc5f1407b5

  • SHA512

    7846c681794d2da0d74a5a9cbe2e40137dec687a659b2254a5438d8d507085cb4eb2c95ae5bcea6818fe460fd13548a8e99ad376937cfa5b5a9edc694df63c8c

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl1:86SIROiFJiwp0xlrl1

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2