Extracted

• • Target

    c86a486a36cf4adbb75b89992f5faf45_JaffaCakes118

  • Size

    2.2MB

  • MD5

    c86a486a36cf4adbb75b89992f5faf45

  • SHA1

    804e1e287da7cf178f9a47f47364c6e575cc56eb

  • SHA256

    d9fc8fa35b946a873703cf34fb64d710649d0d45c07e8a4146175adf0e2e8087

  • SHA512

    309878e7b24c2c6319a24286a33d64b9851df4d17691209d0d788fca3b6f793ca966496798aad449a5819a0bcbfbea8b3a4dfe3d6dae5cadd9fc22de599011b7

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWwwd

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2