Extracted

• • Target

    b7ee2b94473bf85b47c81b0b55c61e23_JaffaCakes118

  • Size

    2.2MB

  • MD5

    b7ee2b94473bf85b47c81b0b55c61e23

  • SHA1

    b9b4f50d2db163771f1cf0031d5d9bf886c2f410

  • SHA256

    151f8ac9fbb8ffe757a7f5d96c486429dc29bad333200570aaf87a8357cacc8e

  • SHA512

    a8d0254dfa605f959f1146680dde1b6e4781cb3a6cdbce3c9455436aa8383021091257b63bed51171811e3ad5adad341503044785369a46ed385b11169cb90a0

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwp

  Score

  10^/10

  ponyevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Modifies Installed Components in the registry

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2