Extracted

• • Target

    ca4d866b2b6101778e5eda20fe2b6e1d_JaffaCakes118

  • Size

    2.6MB

  • MD5

    ca4d866b2b6101778e5eda20fe2b6e1d

  • SHA1

    868561adc68bfe5cef2d0a34917f9665f99944a4

  • SHA256

    b99cf0d333d34247348384a36a01586f73bb42ec8aeaa14d66a66e9ba1d98853

  • SHA512

    c2aa9993d0975932d7029ef08faa7261eb99957e48b86c8921912a67ac37f03d8dbddb3bd691935a5c86a14a219d7ddb6172deab4aac5a967c260f64111daa35

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlp:86SIROiFJiwp0xlrlp

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2