Extracted

• • Target

    ae622a939e55a91cf373e9529dda398f_JaffaCakes118

  • Size

    2.6MB

  • MD5

    ae622a939e55a91cf373e9529dda398f

  • SHA1

    13bd544846ddc8d0f82dd31eb8136e5245eee185

  • SHA256

    c472f41d69b739a9bf2e7bbb3d212b043d1bded4e3083dcf95fbe7b93c75ffe8

  • SHA512

    69abad11bb506b7c91a5d5cf83317880d58934df2c7cc12df3bbffaf060cba2f9f107ff196b871fe3bbe3db1648e9596d17a2f032d0ee75763c5db32282efbb2

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlB:86SIROiFJiwp0xlrlB

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2