Extracted

• • Target

    cb267bdb1bb1b91b0bc7009f7f8b6a3a_JaffaCakes118

  • Size

    2.2MB

  • MD5

    cb267bdb1bb1b91b0bc7009f7f8b6a3a

  • SHA1

    d0b5d2ac927111b2c128252278e897d33ca7359d

  • SHA256

    27ae4b80233051abac9568b62f6aef3768c2cf82863028d5199a1ba45d5dccca

  • SHA512

    9b85b33415e726c18430de865fb32843a2b9b80a78a3a1bafd3efdd2555829e66eaa077234471c9daf133c4287e8ca135db45877bcff6a96b0ca081b903eeca1

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ4:0UzeyQMS4DqodCnoe+iitjWwwk

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2