Extracted

• • Target

    cb7847e6dcd8e083350e2d17fb9d4bb1_JaffaCakes118

  • Size

    2.6MB

  • MD5

    cb7847e6dcd8e083350e2d17fb9d4bb1

  • SHA1

    187eee2199c2bed1004f8d7b53c755ee1c237ece

  • SHA256

    5c356ad2600feab463bd7c9edbc37da2b8793556d30287d3c2d5b3d2603d8c66

  • SHA512

    e3e68262afd57221e883aa4ffa07b8ed3ec70bb0552292ff8899d455e95af656d932d906809b46096fb18a90aeb5d38dfd4ae4ffed14ba320a8a2bd28ea83d86

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlo:86SIROiFJiwp0xlrlo

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2