Extracted

• • Target

    ccf52cebf9da511fded1bd870f79ddc1_JaffaCakes118

  • Size

    2.6MB

  • MD5

    ccf52cebf9da511fded1bd870f79ddc1

  • SHA1

    ff4bde73c9ff0a9bcef7b635d8a7d20944e9d522

  • SHA256

    8ca6f3efd3ee7769902a17513a81c63224bf8a38f19dc5f03a1a6294929764bf

  • SHA512

    61ab7434e165fc0f4a9d59031285b5262c0920a96ee410563826af26f1e113282ef24b61c19655069a117c7449566608df259157255cedb43cfbe94b4f09739f

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrln:86SIROiFJiwp0xlrln

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2