Extracted

• • Target

    d9fdb708ca3c0b07fdc0528b2130a654_JaffaCakes118

  • Size

    2.6MB

  • MD5

    d9fdb708ca3c0b07fdc0528b2130a654

  • SHA1

    13cb1eea18aa0be3d2d56fdb6e315b93c208c39b

  • SHA256

    5cf82856b22981ef997683c82d9a12cab63cf5c2693ccb68bc1aff4b76aa56c8

  • SHA512

    c2ad0e3a4ae146ceaab77abb93f285ca85d35ba0eeb82afa0f6c57015ef4816e3326b2fed14ac2444ee6b3b78aa0c31adad3094b4bd24b1453241b1412eccf19

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlA:86SIROiFJiwp0xlrlA

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2