Extracted

• • Target

    d665aad10035a7086296aefe564c9366_JaffaCakes118

  • Size

    2.2MB

  • MD5

    d665aad10035a7086296aefe564c9366

  • SHA1

    22503cb73c2d998bc3ea014d5c667d01562025bc

  • SHA256

    9b6557031641b9869a56fc24af06d1ede2c1bab0809f7192e014d4ef55a80154

  • SHA512

    20de33cba819cf5582dd8d1a0d0dccaad3450d7834cf62aadac166e17958ff2cfbf485969fb402d4c3b4e032afac93cf9a46c1db87d1ae86443ecf2c47c58a54

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZs:0UzeyQMS4DqodCnoe+iitjWwwg

  Score

  10^/10

  ponydiscoveryratspywarestealerevasionpersistence

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2