Extracted

• • Target

    d7c1df7b83646d17510ec71f04e3eaa0_JaffaCakes118

  • Size

    2.6MB

  • MD5

    d7c1df7b83646d17510ec71f04e3eaa0

  • SHA1

    27a4c91efde8cf26a17afc125f0d9cb6776e7511

  • SHA256

    d0c8d6a94bc85343cbdf9ba5e8f77adba5cbf6489f7b51f84c0e9cd04252528a

  • SHA512

    1cc651934712e5e0da596f3c076f9a4b54c3a0fdea051439281c15807b1ae61054399748be38b8dc476e5790919e0ec38028ff9e3dbb1b809e9fcbdb2b273b06

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrln:86SIROiFJiwp0xlrln

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2