Extracted

• • Target

    db0ee6e8c78e9876c7aaea7f8ba6389b_JaffaCakes118

  • Size

    2.2MB

  • MD5

    db0ee6e8c78e9876c7aaea7f8ba6389b

  • SHA1

    f89d90904498b13bd33151294347f9ee16f0b6fb

  • SHA256

    f1f8c419b6f15bc687e2722697279c95febd20d30f48833dfbae3a10ced46b13

  • SHA512

    5ebf0fd9dffcc022d5e29e987c3a6f22c8ab5346108d28b4e2a7e771c414beae1fa30b5537c81aa2f05faed8b3892068fd8a415b8a90612e3137d3dbdb2e1f34

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwV

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2