Extracted

• • Target

    b32eef7c1724165fe00d640db2892c00_JaffaCakes118

  • Size

    2.6MB

  • MD5

    b32eef7c1724165fe00d640db2892c00

  • SHA1

    fbd7d3d03c3cae8a156f1fbce7b4ce576fd7b28b

  • SHA256

    476c91174cebb13f3b4eeab72d6aee9769e157ee126f2944afa727b4a60b327b

  • SHA512

    171a2009e4e56ecaf8be742eeef036ff9f9e27441086303b3c3f79d6f829776b79f2893db42b066014dc72ee1fecf4d63cc68ad15c70af37a0683df5f556adcf

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl0:86SIROiFJiwp0xlrl0

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2