Extracted

• • Target

    c936279370199ec451d152275592f093_JaffaCakes118

  • Size

    2.6MB

  • MD5

    c936279370199ec451d152275592f093

  • SHA1

    bb30e2bbbff9974ebe87cdbf153244f18b53c7d6

  • SHA256

    be2aebcdd3ea323bcff8f15b80577e0860881eecb3090ac97d36b64698854e4c

  • SHA512

    6abe793b6dbd3cf09db05cf70767c4e6dffda4b6e517beaa3a25edb05b6a29269245debe675be163426a905bb9dfb84e9d4949a03da4e9b2f03419f701fc6415

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlY:86SIROiFJiwp0xlrlY

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2