Extracted

• • Target

    e5a3db07792b1766a74867a578a7eac2_JaffaCakes118

  • Size

    2.2MB

  • MD5

    e5a3db07792b1766a74867a578a7eac2

  • SHA1

    a7247630cba710d713b3bb90ab34280487319bd9

  • SHA256

    5ea7d56161dd367e67d6278023d7595851abbee7b5f5cae7fb7be215f0b3e1d4

  • SHA512

    f9033926bb716a9177ac41b4ee8441acd3c7bdfdba4c9df58b4ea54c178116ee51b8f1560b63371d694ec347991e2219bf8b9bcecaf749839e670a003ff5bd70

  • SSDEEP

    49152:0UzeyQMS4DqodCnoe+iitjWwwmnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnK:02emwmnnnnnnnnnnnnnnnnnnnnnnnnnK

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2