Extracted

• • Target

    ae55691ecd0404b273c510c787ef88b7_JaffaCakes118

  • Size

    2.2MB

  • MD5

    ae55691ecd0404b273c510c787ef88b7

  • SHA1

    e44519aa7296b28c8943afb0a28e6fc7c7e1f110

  • SHA256

    7b557262bbc213740edf3ca5ad3afd1215b7b21379a889feb94427d659e2b8e5

  • SHA512

    358115778ed6dff29e8fe296bfd7e0c2e2a67bac123ee5e6c85dacaed87d0b98a1284a9b746463e9da6dc2dac914f5e29c0e7c779b39ad6efa66ea04ba28bfcd

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ9:0UzeyQMS4DqodCnoe+iitjWwwR

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2