Extracted

• • Target

    cd2aee20f34911905e3f789a9cdad55e_JaffaCakes118

  • Size

    2.6MB

  • MD5

    cd2aee20f34911905e3f789a9cdad55e

  • SHA1

    101510f6b3e5aadd6eb44592aaf4ed3470d42ba8

  • SHA256

    330a59b99253d1ab77378563f992631db67feb144bbb4e13cf1faa9a86400bc2

  • SHA512

    d53430dd3bef22ddc033c5a5bd0303a470e5b4f9b4368702e5deba8293fc97627e474d4b7bead8089e0b4158f7788b98b199e781f9ca762325d4393dd593e4e0

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlf:86SIROiFJiwp0xlrlf

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2