Extracted

• • Target

    d0f2ce52a6131d95f2875e053b41e09c_JaffaCakes118

  • Size

    2.6MB

  • MD5

    d0f2ce52a6131d95f2875e053b41e09c

  • SHA1

    0801884341ff86e047a15365db9388c8bdcb1326

  • SHA256

    c50b633e79a71862c831c2121311226b3327bbf75d13f28babedf4a4a547bb63

  • SHA512

    3fe093585850d402591dc60ac406a10ec08af05b3493acab836427fd6e1196121dfc8168d28d1f36056a04057c66c9a46552779c2735cb59fa7b23619ff2d08c

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlq:86SIROiFJiwp0xlrlq

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2