Extracted

• • Target

    b7deff7e2c8a14c92566942a2039fa8b_JaffaCakes118

  • Size

    2.2MB

  • MD5

    b7deff7e2c8a14c92566942a2039fa8b

  • SHA1

    e517f2976ff1a7c467e7429c1282f6260b7f7bba

  • SHA256

    25102592137c6ab16019add1fa4b2eea5b7dfd4420ea163ceecc497baf7ac446

  • SHA512

    df74d394f372fe8e27679641ab4973b6dbebafd46087032817218acaaf8472a9fbe5a5d51c92e3d02cf4bbb309901475446e52d8f3c410e1a4cf2f62cbd16999

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZy:0UzeyQMS4DqodCnoe+iitjWwwO

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2