Extracted

• • Target

    d5c0fdd9fd649079210bd80e0b0a5cca_JaffaCakes118

  • Size

    2.6MB

  • MD5

    d5c0fdd9fd649079210bd80e0b0a5cca

  • SHA1

    a184d8e4cb027c984ac1d86bd069c95bb24f43e1

  • SHA256

    6f075dc1043a66a6de779996bc0373434cfd4312e867cd26c7379516828a7457

  • SHA512

    c801d9713e86be54a6f546d584871b95e2f5ac0b40f6b9ce1d1b1a541499194844ce962d999eecbcf4c7426c01db43aa9b708453630e628ded03bfffc062295b

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlf:86SIROiFJiwp0xlrlf

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2