Extracted

• • Target

    d13b227051912ea4ec2cc11ab47cca40_JaffaCakes118

  • Size

    2.6MB

  • MD5

    d13b227051912ea4ec2cc11ab47cca40

  • SHA1

    f5371944c8ec0d30027f26919a52a206c719369f

  • SHA256

    f756bbea891d7a0d175734b10e9f602f53481594db5e8485e38e4eeee5d04a5e

  • SHA512

    1b2113bc828fb7c3be6a2100bb8502d117eb24d814d4343a375c312388275ebe807e7542c86782633dbba3005afd0ae250a66033dca4453c38236e04c24df875

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlU:86SIROiFJiwp0xlrlU

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2