Extracted

• • Target

    e20dab05a5ddf8bd3a4a0dba649e0a29_JaffaCakes118

  • Size

    2.2MB

  • MD5

    e20dab05a5ddf8bd3a4a0dba649e0a29

  • SHA1

    5543fa4a54750d9da5961ecbe3ad28d4c1c602b1

  • SHA256

    d8fed6493da020c13621911b755bfc47495ce9046454421699adb88a4afcc8b2

  • SHA512

    f5d0d5725df6479ffc49f7796ca1d0841cc91fd1cf2891993067c963e1a8356944c7a9f91b55927f44a64bc13b1aabcad01015e765410a2f96179e677c12b520

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZf:0UzeyQMS4DqodCnoe+iitjWww7

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2