Extracted

• • Target

    b3d8148b478885ec6015b63c70231af6_JaffaCakes118

  • Size

    2.6MB

  • MD5

    b3d8148b478885ec6015b63c70231af6

  • SHA1

    b3a0868fe91c05f09ffcf40b6c5e3737e5ea7706

  • SHA256

    f70aa8371f671081fa1791a8d42937613c718fabf33a88d2420515a9a404dbc1

  • SHA512

    07c055480da1c3d01016bef534af50b45fe679d14be1f9b8c5d726eda798d3ba8004bf2f2c92b60712081861430528a8d91e3ad2e1dfc354fb9c5775cbbaf6c9

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlC:86SIROiFJiwp0xlrlC

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2