Extracted

• • Target

    d2febfbed038426b50fa60c3edc4e2be_JaffaCakes118

  • Size

    2.6MB

  • MD5

    d2febfbed038426b50fa60c3edc4e2be

  • SHA1

    836a73d44c10faba62770f28b86888003fe350df

  • SHA256

    1085afdf1a24b77227172d606b8e0a30561b65d7d294bd3c4cca77f685ca97f3

  • SHA512

    af5dcfccec6c5f962c8558dee45b9c5b335f56d948a73b8a0a4a5718a2b6a8b786bec72b45a63f9e0b5c960ce6d5d3c3b2a323ea76e939d1f215fac368a76f63

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlu:86SIROiFJiwp0xlrlu

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2