Extracted

• • Target

    e55fbe5aa46323c519c58d63d5a8b3be_JaffaCakes118

  • Size

    2.2MB

  • MD5

    e55fbe5aa46323c519c58d63d5a8b3be

  • SHA1

    ac37dfedf00f423168472b8041b63e16331efaed

  • SHA256

    fc2bd0b39f01ed36e96d43f4d63137f3fb7c17fc03e819c054e3febbaf82cd10

  • SHA512

    487fb0592b884c80ef2077fb2ce6556df6f024ac95b4ab1661a8aac7c784385106d669af1cbe45a31837e6ad166f9ef3d017e618759c37e060ab0c53578a8f24

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZw:0UzeyQMS4DqodCnoe+iitjWwwc

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2