Extracted

• • Target

    d6f9e1ed52f97d75a46aa1aeb2a54931_JaffaCakes118

  • Size

    2.6MB

  • MD5

    d6f9e1ed52f97d75a46aa1aeb2a54931

  • SHA1

    03f58ccdd7159be37d6139859347cd5f56c7db7e

  • SHA256

    a07d387cde7b8b13e4e23b4bb70173886ae58ef7b95e5d765184d86ff0de690d

  • SHA512

    b7c5e8a506d18a6c0b8327a2f68bbf6cfc0bbdf894af3a007f146c7ec67d304fe6521950f25de061fdfd6f1758ba463ba90cebae649d0cf5859026ce36a4e0e8

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlB:86SIROiFJiwp0xlrlB

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2