Extracted

• • Target

    d3ab724ccadf76cd039d6d7ea98bb8bd_JaffaCakes118

  • Size

    2.6MB

  • MD5

    d3ab724ccadf76cd039d6d7ea98bb8bd

  • SHA1

    8662fe31c6791eac8dacdb9f963ca7398d1a266c

  • SHA256

    da2d1ab789afdf12468b83a83fa86898632e6d9c3b6aaf13fcda771dee1ee6d6

  • SHA512

    691f6edfd5fc17fd30009e54b626d7070f691b7557f8e5975df4f5a2a057c656008188cab1dba5880c1f74fbcf42113a6cdcce5533f7184b19de43dbe06002ab

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlC:86SIROiFJiwp0xlrlC

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2