Extracted

• • Target

    dba6af24e6eb9fdc954f61589d1d0555_JaffaCakes118

  • Size

    2.2MB

  • MD5

    dba6af24e6eb9fdc954f61589d1d0555

  • SHA1

    7801e14f237408161de467bf04970d88fd79a50e

  • SHA256

    c431ab44f97d88352784d8a5786c75c651be6650a222d2be6b6bc27dfda1ef52

  • SHA512

    a27b801f078849aeea407d22509a56988fcb2001e5e04b73633bb68c72b44e035f57fb2ca20a1c9a75a31c9f5bf5d6d05b7dbf314e763f94e90df8a815b25e32

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWww1

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2