Extracted

• • Target

    c96e9769b35b87a5fc6d41562a3d6d85_JaffaCakes118

  • Size

    2.2MB

  • MD5

    c96e9769b35b87a5fc6d41562a3d6d85

  • SHA1

    54c4fb6b99b9fc808af79ebf842890d1ad5e6a28

  • SHA256

    0e268aa60dfad0415efa3c4e482982480366b6d0d44babc127897112f2bbc6ab

  • SHA512

    3274a6db2461cf83bb7fd49b13cdb7dd13967d527b917f552a0081ebc2c4255e569f275619600e2e99392fcbc52e7407b889c3d1702903cded58d7b1e3fe0e7d

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ1:0UzeyQMS4DqodCnoe+iitjWwwJ

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2