Extracted

• • Target

    ca6d56441a5285baa51c7974147609bc_JaffaCakes118

  • Size

    2.2MB

  • MD5

    ca6d56441a5285baa51c7974147609bc

  • SHA1

    1a6dd638c13ab5f8b7c80d269d87174c5102a3e0

  • SHA256

    1e7f1d7b624add1cbc855bf7feaeb111857d1ce0046cf380920c34d1a1c5a938

  • SHA512

    a25b68029c473767ebfe06be9dfcf65d2b5350d45e1000f6ed445e3551ae90532e6828d98897d4911416923b73d6511405b93dfaec7fc0496f79b01a39d4a4ca

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZs:0UzeyQMS4DqodCnoe+iitjWwwo

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2