Extracted

• • Target

    cb3b8139599aa15b1bbb3efe59687124_JaffaCakes118

  • Size

    2.2MB

  • MD5

    cb3b8139599aa15b1bbb3efe59687124

  • SHA1

    0250afb6238f914f82cfd1992f91d37605ef7ed4

  • SHA256

    4706300fe1e00d459c92b702b7f820cf2c148366b35ed6e29e97a6a55aadcd3a

  • SHA512

    b770737e7e77eff54d4537c82a11c67bd37810df0046ef4d8a1ba382fb250dfd2c439dfa97dd7044eaac93dea44b2a1cfe1dd2db407faaa7926adf1984a32d6e

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZW:0UzeyQMS4DqodCnoe+iitjWwwC

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2