Extracted

• • Target

    c89fb55ce49635aa57fcd85e97d90e74_JaffaCakes118

  • Size

    2.2MB

  • MD5

    c89fb55ce49635aa57fcd85e97d90e74

  • SHA1

    b1cab4a8b6103ccc7f00dadf0f7e0545e764b276

  • SHA256

    97a0e1ec8cba75fdb29f17142d5693f4af7ff828e6764626282e1b012cd01806

  • SHA512

    423233fe4eb287dc977a918c7f13b14d5faab9c1a899b151c1048d7c18f3b7b289491fd2d72c288d9b4051a0eb2c155f7a5200e2c6c9a8d817df177edb51c6e0

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZN:0UzeyQMS4DqodCnoe+iitjWwwx

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2