Extracted

• • Target

    b0f5c1ec44266ae33d2647243b969050_JaffaCakes118

  • Size

    2.2MB

  • MD5

    b0f5c1ec44266ae33d2647243b969050

  • SHA1

    8d5c577a328f34f30979aa90b1cc598b6916157f

  • SHA256

    b0e813ffc627f0daff5ab1c43bef6b1e3795e63aa7e48ccae31710c2d5139947

  • SHA512

    2e3cc5ce0ffafc1a0ea58c8fba1e3e24f0f2785185a0a57c265b5951eaebe22c027308f1ae1f2e687baed624eaf20ec924b124fd5815954731d5558a7982e028

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ8:0UzeyQMS4DqodCnoe+iitjWwwY

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2