Extracted

• • Target

    cd5c6529c78a90ed5890126c0aa1ab0b_JaffaCakes118

  • Size

    2.6MB

  • MD5

    cd5c6529c78a90ed5890126c0aa1ab0b

  • SHA1

    d25f1b6c25316002037e8996ffe6de7b24dcca0b

  • SHA256

    0def36abef03c38ddad47afa15547df7a17050c3168095504beac174f7f6d721

  • SHA512

    e950032198043a08fdc5c9a2cdbacb65592513844cda897bc5e54baadd1666234e474bd26add2d2dc4d5dd0c391395bbcbc9b85c5f8a368271050a08dbeedd3e

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlt:86SIROiFJiwp0xlrlt

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2