Extracted

• • Target

    d7cede7eed1af149319b763cb6af58fd_JaffaCakes118

  • Size

    2.6MB

  • MD5

    d7cede7eed1af149319b763cb6af58fd

  • SHA1

    d025a44b0f7568e413ce938a41b10f58b179d2f0

  • SHA256

    9491e8c016176abf1c7adb1bd51f6d62b6e26bd6e43efdfab2e0c76e5e2aa5bd

  • SHA512

    bc6b631f4a06f8b598cefe530c25526eca93c4ba5577613172388415bf2f6d20013c7c751e5637e52f8d60c118be2bc27c1cc2f0b3e6b423498788af8ea10a48

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlL:86SIROiFJiwp0xlrlL

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2