Extracted

• • Target

    e5aa8f484d2a2b5f6cd9fd8e983713f2_JaffaCakes118

  • Size

    2.2MB

  • MD5

    e5aa8f484d2a2b5f6cd9fd8e983713f2

  • SHA1

    72d90994b6819041d400859f641c52e308b1d503

  • SHA256

    3d634c92887657c5aaf043c2ef5fc8b650a0b42f673813a304fdea9cbba4791d

  • SHA512

    7d15745704010145cc26b39f4b312bc2935a9e38d9be5d4c1a6e5805c2ed7ccd747c3595a9994c88f70b7dece924d93d8075f75e245eea3f6e74ecec7bb576e1

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZA:0UzeyQMS4DqodCnoe+iitjWwws

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2