Extracted

• • Target

    bd9ee3ba65db2eb79373f02290616165_JaffaCakes118

  • Size

    2.2MB

  • MD5

    bd9ee3ba65db2eb79373f02290616165

  • SHA1

    b5183f3928f839a5a57d214c68f878ac490abc23

  • SHA256

    e79d79bc8509d221e0793a28c873be0dce01fe4609eab926b86c3b1209deb1f9

  • SHA512

    bc6dd7cb743cecc60202d41605c68999a9786cc57547c2c9a311a4e1eb8078180efebbca7f4352749dc8dc9adce736b87b672a807b02f3f2ce9af5ed89e0ee16

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZM:0UzeyQMS4DqodCnoe+iitjWwwA

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2