Extracted

• • Target

    dd87a38b4bea0dc5f8ca831720edc8ac_JaffaCakes118

  • Size

    2.2MB

  • MD5

    dd87a38b4bea0dc5f8ca831720edc8ac

  • SHA1

    4ee3cb453f343d21ab641b494706fe8ee9388a14

  • SHA256

    1d71f275668f2fc4e4a031e2c1e9954cf5fb99c8db27ba34427b5d1641f524cd

  • SHA512

    4c0d11e39f75179230d6c04e36d23ed17edac5eb2c26b254ecd62f7d60b918e9daa39f00f9394fc5ee95988953716f31ad6870020d6f78476072b0e45cc2d8b7

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZc:0UzeyQMS4DqodCnoe+iitjWww4

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2