Extracted

• • Target

    d7c5dc62b28a9b0190968e9eb2722baa_JaffaCakes118

  • Size

    2.2MB

  • MD5

    d7c5dc62b28a9b0190968e9eb2722baa

  • SHA1

    d4f1e8a1121cf88f6fd98626f7cd4d66d2d68295

  • SHA256

    cc783fd35b476e8a77a44b582a6d8ddab7dcc011dc1aeb9917edbcf8293d6fd9

  • SHA512

    edf29d465c6a6646531e6119a7542c185b26bc1e4539c039e2b3accada70aabea2257f3b5cc174e139fb34fb20421e72eef4dbea81e2d72e62b5581876db0628

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZi:0UzeyQMS4DqodCnoe+iitjWww+

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2