Extracted

• • Target

    c957f3294777eae4ce4f62b6dfce1e0b_JaffaCakes118

  • Size

    2.2MB

  • MD5

    c957f3294777eae4ce4f62b6dfce1e0b

  • SHA1

    3e63f95ee3d9cba0837d29d5dadb4dea9c5096b2

  • SHA256

    76cf0d6556a6f88fca9317fdb8091d47f6fef048a60e9492be1d2e1c2b969cb4

  • SHA512

    0a842d353e8b31ff72b848ee50dd0205c026890369d62e7193cc79e50bdc4a0e11999888cc254404f32c86b3c028538237af92f74c9335e3981966eb9b099f12

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZJ:0UzeyQMS4DqodCnoe+iitjWwwl

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2