Extracted

• • Target

    dd975d49f2d68e60dcb5b3fa0503a3d1_JaffaCakes118

  • Size

    2.6MB

  • MD5

    dd975d49f2d68e60dcb5b3fa0503a3d1

  • SHA1

    316ec1a28a0c3407c161deb1527a8cc6e6fa2ae1

  • SHA256

    9bf0be809020a8af2600d97b75b223862ce97c25df01efe0fc5b67f841a920a0

  • SHA512

    f21951cb32b22f1d744c6cd91f65a68954959bffb697eae8e24f816b96e6c3d41e992f050adf3466b30d90a031565e024bffe8189dc960525b9a8b1cf7dcfbd5

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlZ:86SIROiFJiwp0xlrlZ

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2