Extracted

• • Target

    c84ef5e98b5a2c655f78482644aa1dcc_JaffaCakes118

  • Size

    2.2MB

  • MD5

    c84ef5e98b5a2c655f78482644aa1dcc

  • SHA1

    35e63b877bc49e48fa11fba0b1e27a253cb43de2

  • SHA256

    56e1ef0dd1b9e0184a0156083c23684d9ec5e2982d1095488c57e17831cf3568

  • SHA512

    4209022b0956c0770fdc15dac2eaef865e2af3b4a29dbcdfe1fa4845949570123498ad12510346f3bb885630b15ff2d446a0d8cafdd3133e2c69dd62b318b096

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZY:0UzeyQMS4DqodCnoe+iitjWwwM

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2