Extracted

• • Target

    e4eb889a6742b1b00e1beeef308eba39_JaffaCakes118

  • Size

    2.2MB

  • MD5

    e4eb889a6742b1b00e1beeef308eba39

  • SHA1

    55edd98d6052d41a46bf2ffcf0377d914b7263a2

  • SHA256

    d44dde58c4c37f31ba167b416ba483854018f474bdabe721fe7f94fba9176e95

  • SHA512

    60a65505e7c029f4e5064020c1cd4180a15e7aa5e917ae518da34a3a760c28b5c856f2e1a322efcabcc47827e94acf75d699d17d057390813169e5b8fb5f103e

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZz:0UzeyQMS4DqodCnoe+iitjWww/

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2