Extracted

• • Target

    b1cae55c0e15b8d03dc31fea573a0619_JaffaCakes118

  • Size

    2.6MB

  • MD5

    b1cae55c0e15b8d03dc31fea573a0619

  • SHA1

    b4dfbddf3dc5dad81cf13c710ee8ac015fca0a88

  • SHA256

    22e292a86bd4fc09d90bad2d9f20f09607091e51c0cfbf902f6f68522dd95ad6

  • SHA512

    494253f3ff9eaee2b58d2d2cec8a584f4570fa0e11ad2ba368c01d54a760d6fa05039ff152d7e40d82df6d9470a95c96cd4e4e0762efc435279d6d0c31574b82

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl0:86SIROiFJiwp0xlrl0

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2