Extracted

• • Target

    ae84f51327fdc36fb6f272ecb31df532_JaffaCakes118

  • Size

    2.6MB

  • MD5

    ae84f51327fdc36fb6f272ecb31df532

  • SHA1

    3146442879db89f71c85eb2c540ba69491be1519

  • SHA256

    edbf129740a61bcc7483b8daaeb9eb6733f87d08f7b38ded0556892cd9ef1a21

  • SHA512

    3dde675b763b5fc6910efb6820a6d141cc81c7c7b3c2406bd718e1785230d8e8967def04a3a7a1a017bcbfc498c49cc6c45a40c7ccd384aaff830750500e1bf3

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlEIIIIIIIIIIIIIIIIIIIIII5:86SIROiFJiwp0xlrlo

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2