Extracted

• • Target

    e51d2afcadd8b33f8ce1fafb42c7bdc2_JaffaCakes118

  • Size

    2.2MB

  • MD5

    e51d2afcadd8b33f8ce1fafb42c7bdc2

  • SHA1

    d6d633f1f24b0e0ce3b026df2ba380e841f7cc19

  • SHA256

    a52ff3c88a299d6efd3e3b95fc9d0b4b52bfb6b14872f4146bdbeda1b8d6c5da

  • SHA512

    fe98d8784b149621e5eeeb89dc5f1ac45f485c182dc617f6057db5d171caf97940247049e6c53aff1a98b1c7a095a3a64cef764a7b2d602c71d7b8e2b04da4f4

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZV:0UzeyQMS4DqodCnoe+iitjWwwB

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2