Extracted

• • Target

    b42a7c442a51ff9fae943454fb3a1d97_JaffaCakes118

  • Size

    2.2MB

  • MD5

    b42a7c442a51ff9fae943454fb3a1d97

  • SHA1

    06c59255a286632d53e1b493705a4e6d3d686ed8

  • SHA256

    c932e6b71b730a750d72e03d3b3e1622420a4ea4cfba9a071cf533e9da517265

  • SHA512

    217c9ebfaa4e2bc84ea569416787933d79371393c9922aa7b5299f3a44c7a739afe2bd4471c4f1955281bcacb2642baf8909fdf9043baebda5418eb495ec98f7

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZp:0UzeyQMS4DqodCnoe+iitjWwwN

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2