Extracted

• • Target

    c96d72d1fa9fee9f23f4b4500b0bb3ef_JaffaCakes118

  • Size

    2.2MB

  • MD5

    c96d72d1fa9fee9f23f4b4500b0bb3ef

  • SHA1

    2252d6772abc053c4e2a6e791aa3b4828d2a97c4

  • SHA256

    7cccb0274a0dcaa929de3abc959b5d193082d16214636ba310a2ed461cd6e75a

  • SHA512

    b244486bf6bc6cc43ed6657bbec27a6e2425d12b3abfe50e1da8b2374cf8a165af538f84a0127be072f21b8adbde84f86881d17971c10595c93faf384905d5ca

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZX:0UzeyQMS4DqodCnoe+iitjWwwb

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2