Extracted

• • Target

    caa3c45889022ec32ab093cddb0c2e6b_JaffaCakes118

  • Size

    2.2MB

  • MD5

    caa3c45889022ec32ab093cddb0c2e6b

  • SHA1

    468b27823fe5e858f6041d7e2c949872345a4aa4

  • SHA256

    03c04d038f249167edaed5531f311f58dba111317309eed06bde170b14d714a4

  • SHA512

    076289c66946e7e21d9d7e32ac1ed58892cad8d50217a3d59629c7673ac8185dcc51ae3de8d60e451b5407a48c1b04e6899b3214bbc1040e03cc0b57312326ad

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZd:0UzeyQMS4DqodCnoe+iitjWwwZ

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2