Extracted

• • Target

    b437f7e9beaeb888b01cb66099f9fb92_JaffaCakes118

  • Size

    2.6MB

  • MD5

    b437f7e9beaeb888b01cb66099f9fb92

  • SHA1

    4120e951549b16b3e4eba2de1c24ed77b23980c2

  • SHA256

    d047ec9f8f0aa559f4781904044c50dcf69af5a64f60212b54f24f40fef65987

  • SHA512

    551e827e73a1dae30fc41b354451d0a37612ccbd7aac8400c8b8043324579300dce33c5c7657a6c5283f896f4c19402201bd55e99c5d7b7cc2a0046e79fb4458

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlu:86SIROiFJiwp0xlrlu

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2