Extracted

• • Target

    d194e1c281b540225601a7acd1da3126_JaffaCakes118

  • Size

    2.2MB

  • MD5

    d194e1c281b540225601a7acd1da3126

  • SHA1

    3e0ee558177530561c36b622f61a57a1c635f461

  • SHA256

    728e4d205c69537943d7a5b1ff894b92d9b26a48b39f42e7f6fd997f15b9070c

  • SHA512

    51f16be9ddc8a9f4f95c6aa61146a1fb666a696ac5c1d4bf098d75b70afe217fb2ffb8bbc3d199df1e4bcb7a5a317abf1b5400be573fcf5623abf52c952bad15

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ3:0UzeyQMS4DqodCnoe+iitjWwwL

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2