Extracted

• • Target

    e7cd04571fc6e04be23b28d245db8fdf_JaffaCakes118

  • Size

    2.6MB

  • MD5

    e7cd04571fc6e04be23b28d245db8fdf

  • SHA1

    6032c4831652decdf5a2de26c4213ceebef0d539

  • SHA256

    1fed0a8c64c528b01e591c706314ec40d043cd0c72a4c53c9c2048e82cf2a172

  • SHA512

    43c7b2732cef3b8ea69581fff538f774103fec89c40148b10bc6e4d91f4a874ac5985af4e293a0bf2efe5642faeb1c8888ab454df2db43c822b5bc65c0ac8c73

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlc:86SIROiFJiwp0xlrlc

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2