Extracted

• • Target

    c04ba01565321b795edbbab954ea2db1_JaffaCakes118

  • Size

    2.6MB

  • MD5

    c04ba01565321b795edbbab954ea2db1

  • SHA1

    cf20352f7655c839733a6e53a154f0b08d41e8ac

  • SHA256

    dd39282afc487ec73db409d0fc6820f0c659d272922738f92ce6db595b4b7df9

  • SHA512

    596f79087ef524450ae4b2a9ac64497179c65a2172143e5f193c253cf923471b5fe99c1bd7dc9707b3221bb6cc828584863e64e73d6bc89ac58e732b18af9679

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlT:86SIROiFJiwp0xlrlT

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2