Extracted

• • Target

    ae963c876b4cf9e4c07855aa1080c438_JaffaCakes118

  • Size

    2.6MB

  • MD5

    ae963c876b4cf9e4c07855aa1080c438

  • SHA1

    19f804238d7d68898d0001b10577087b406f6c37

  • SHA256

    0e9c92109f0da3af9b25e01dca72fab23582ea3d8e5e567605f5b69392748cbd

  • SHA512

    2829046059b368bd733c7fedaacdbe253ff63dedafe631ae85b79bf25fd3142fcfa83f8d6c22dca073d60af68997008ed9fa516f1a39f998fca3f58fb35baa43

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl9:86SIROiFJiwp0xlrl9

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2