Extracted

• • Target

    dbb3fed1ddbe1dba7915ac77f70fb445_JaffaCakes118

  • Size

    2.6MB

  • MD5

    dbb3fed1ddbe1dba7915ac77f70fb445

  • SHA1

    1fa65a682d2ccf5c961b73f8bd8670a2169aefc1

  • SHA256

    f44d696d38b639db5546aabe65b04cbc374cfe2f9d3480087c00e0afa42da137

  • SHA512

    e58ab91c2677a3ba64ec4c697bbf9392fb66030dd5bf313697b6da844b9fe8c329fc6c1f88eee3f12a1badc8b3ee997eebd775733199defde5af52fb133f7351

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlj:86SIROiFJiwp0xlrlj

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2