Extracted

• • Target

    e164e3f2d76bcd491bd495fa44941985_JaffaCakes118

  • Size

    2.6MB

  • MD5

    e164e3f2d76bcd491bd495fa44941985

  • SHA1

    8908eec3c17ff8c02a353c1a21c38d1a7e7ae1d3

  • SHA256

    075bc1f0d1222d13c2a8895a8f668837f3ce005996b479865b065516fecc5a0a

  • SHA512

    e5d22bc097567c61017d34965f34a7186a830093fad0a37c02169ea89e6608da75bfde452519e2b9bd36bf5fbc0202687fcf2fa7ecd802494f76414d26b26352

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlp:86SIROiFJiwp0xlrlp

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2