Extracted

• • Target

    de7939d57f3e2feb495f07b6633544aa_JaffaCakes118

  • Size

    2.6MB

  • MD5

    de7939d57f3e2feb495f07b6633544aa

  • SHA1

    d89767348fc446cffefdf7f428618bfe0a901bd5

  • SHA256

    2f718bb63fea4d51c28526b7b0fb8f3628bb10b405bf75e3e9cc069c949a3e72

  • SHA512

    db5bcf9e5daa59bddcba73ea2a8e8669706f11035fc770b909e4a1b79cf00a8bbfaa9bc4f9ab74b2b23883924f5810baf415d1921ec9f06ccaf7d6f9fd321308

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlD:86SIROiFJiwp0xlrlD

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2