Extracted

• • Target

    ce2b63e869ede1eb6f3691638dde2acc_JaffaCakes118

  • Size

    2.2MB

  • MD5

    ce2b63e869ede1eb6f3691638dde2acc

  • SHA1

    8be0f4dc89e8d9c683d4a574d1f1090e71797e0d

  • SHA256

    d8fd65f0a63ff3ccdf99312a11da3308a0cfe16caf4d048d37554e67a5095559

  • SHA512

    ca1eca068740132e8be0989bf6d0bcfbbf2abf9ee3fc9125cb079a5ba4d66e0d76373d5ae5b64f905ee8a3b3670171471c8e39ea4e713d148879e9be7cc600a9

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZD:0UzeyQMS4DqodCnoe+iitjWwwn

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2