Extracted

• • Target

    db7339a360d01cc2bd06e203eaacf980_JaffaCakes118

  • Size

    2.2MB

  • MD5

    db7339a360d01cc2bd06e203eaacf980

  • SHA1

    0bf7cd57272e6701c2c4f1dcb3c2d5c7e2ccfb5c

  • SHA256

    168a5b214a1557f867b2916d06fbff7013d5fe77a3212a58bed7a9eef51143c9

  • SHA512

    db378c22fa24e57d4b04958f3382209ec5a1483f8183ac8f78fab2fac2495dc4cce387bed3c278cfc54fe6baf5e9d47d078b1bb2a8f2a5b74ab7a596e0b9ae92

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZm:0UzeyQMS4DqodCnoe+iitjWwwq

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2