Extracted

• • Target

    d90487fe316227e7a0aab433d0a53312_JaffaCakes118

  • Size

    2.2MB

  • MD5

    d90487fe316227e7a0aab433d0a53312

  • SHA1

    2aeaeb7539fc3ce77170e0ea0c8f764b7a275d29

  • SHA256

    53c04c154c0dcf7303d275bf3101f0c0054b4b8113987bbe3ea452859f3557a6

  • SHA512

    335e49e2ef75d2e3f01b476381a2c06be472a00a9b3766411da733d2cf17113237b5e2f2a02c2551a33493c75a69c9e377036e684c24498bd64662a819a577a4

  • SSDEEP

    49152:0UzeyQMS4DqodCnoe+iitjWww5DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDq:02emw0

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2