Extracted

• • Target

    dcbabf31e3a74eabc9f1e7c136f93a83_JaffaCakes118

  • Size

    2.6MB

  • MD5

    dcbabf31e3a74eabc9f1e7c136f93a83

  • SHA1

    1c6fee709ac2162dba5edc857e9dc08b2364aa86

  • SHA256

    ef66e4e61e05772832e7fb1ba9bc0a8e10ecce86f8ce96425eb0bed9e16ed094

  • SHA512

    b657905dd9edce857c4eec2daeda92f8d2935d528cbb8265c94c09cbbe1530a04c43fc0981ff1e78b03a7bfe49ec1a4c086a45318e1964c9367195b149f5d899

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlF:86SIROiFJiwp0xlrlF

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2