Extracted

• • Target

    d4193dbbb1deef72e4daa1a9ef9e85fe_JaffaCakes118

  • Size

    2.2MB

  • MD5

    d4193dbbb1deef72e4daa1a9ef9e85fe

  • SHA1

    6b399f7e8460054a9c79759c3a1f69284974c156

  • SHA256

    aa50f307360f29a4503432144694187c723011e93fb92f2daa86bfcb00e20450

  • SHA512

    d853b8775915c3cd64e6a3f5cb8b4723c34a605f1e1159d11dca8c700808c1cf3d6b73e459777455c8b77c9a2e10b7cb3ae89de2ffffb8ea941eb0e4d75dbca5

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZI:0UzeyQMS4DqodCnoe+iitjWwwE

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2