Extracted

• • Target

    e4ed802138185d95c623ca44cc3c9cbf_JaffaCakes118

  • Size

    2.2MB

  • MD5

    e4ed802138185d95c623ca44cc3c9cbf

  • SHA1

    11270678fa687c57464f41656c86569c58314b49

  • SHA256

    ca8efd27cc54a5c7126c7027a54742fd0d4c07cb81858d44cbb15029e5819211

  • SHA512

    bde6f44eda3c8ec801251da6e55358ce4a314202d070e92fcf5fb3936e9852e5cfb5ff092c6dc6b2a9db4044e1d71b292915922c95a865ec34631805ea1fea4b

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZd:0UzeyQMS4DqodCnoe+iitjWwwR

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2