Extracted

• • Target

    d085e395b350b16d7fbf005bfc72aa21_JaffaCakes118

  • Size

    2.2MB

  • MD5

    d085e395b350b16d7fbf005bfc72aa21

  • SHA1

    9d6f893c7f5cc7c02147e189dc42062de926c6eb

  • SHA256

    c7699da0e19e44a96584803d7fe03705bcc080ca0118e6b58f0eee1f90ac8da8

  • SHA512

    4bb0e91eb0038503b08dc46a59ced00db18fe6106edacc5663a94c2b9daa9ae7bcd169e749c62c5523cd9d4fc7a2c0ef794eeef35d7d519c88b65af3ab81acff

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZa:0UzeyQMS4DqodCnoe+iitjWww2

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2