Extracted

• • Target

    cb6e06d0c117d0e35b792d21d8996f91_JaffaCakes118

  • Size

    2.2MB

  • MD5

    cb6e06d0c117d0e35b792d21d8996f91

  • SHA1

    3bf1e3daad9d961e11a719197265b1bb1e39aebe

  • SHA256

    87e88446d5e869139b7554ddde05e09aaf6696991ff0410b288534d41460433d

  • SHA512

    78e2c59d3998fe2e5403e119dbc13e9afc724cc18b5fcd36331cf2a452c7bfa9d63f7ccd31d3c84188509df41dba02e77e7e1b0ef1ac109898ab61e70afdd2cf

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZh:0UzeyQMS4DqodCnoe+iitjWww9

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2