Extracted

• • Target

    d6d362ab7c508c5c660037b918b579e0N

  • Size

    2.2MB

  • MD5

    d6d362ab7c508c5c660037b918b579e0

  • SHA1

    214c67e69bbf98d1cae9a15e14aa575fe47ee555

  • SHA256

    372888a3a6a9460ffe242b651ef04a92ad7237657fceb86d709c6a5560980b61

  • SHA512

    f6311a24a9f013df2a34be6ed578bd451e3daacc092f9b5197393f8c2d7b4b97182be715740afedff47a62544bfc62290dd1d1ba1640e3023d6cb7c8e4c99056

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWwwM

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2