Extracted

• • Target

    ded514b728157993b2cb346393d69f68_JaffaCakes118

  • Size

    2.6MB

  • MD5

    ded514b728157993b2cb346393d69f68

  • SHA1

    f35ebe6579c88a884d7d29faf92b4498b73889b0

  • SHA256

    0281b77605b40b2e74bc26468142e8a4aee931b556f4438d724480a98814c510

  • SHA512

    4b11c09f936dd4c2e263c8ab512480d4e36791d0d8ecc22c2c396ecefb7983c1bc6e048fc4d18d43de4034c607e8c88ec64d85a851d7ed7bfd27f8d8b0bf3079

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl8:86SIROiFJiwp0xlrl8

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2