Extracted

• • Target

    add1915f39181f8a40825922502d3bb3_JaffaCakes118

  • Size

    2.6MB

  • MD5

    add1915f39181f8a40825922502d3bb3

  • SHA1

    eabf528e358b37f8f1e9e32788407474b3654ead

  • SHA256

    4872026a7edebee7a514b6227d5df643d0e4ab23b565d6ada16f61a7900cf92d

  • SHA512

    5b15dc73bde39288e6a534ed4677d1692d243a3de34e339e949c1bce15b57ac3318a3523b52a2b8274388d40959b89605d3b6ff85b57a53d132727216a997507

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlJ:86SIROiFJiwp0xlrlJ

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2