Extracted

• • Target

    e6f5d722ab06b79e34177ae3faf16432_JaffaCakes118

  • Size

    2.6MB

  • MD5

    e6f5d722ab06b79e34177ae3faf16432

  • SHA1

    17969078d948a8f4d5d5608f398d64b91dcf3f31

  • SHA256

    1092b9ff7bc06de06f58a6dfc3b0492d118ec37bb258a3ee9d01f61a39a9c3da

  • SHA512

    3975cd9f42a9cd575cc08fb800662dc233e40a0622bb2a28ae582f5e5470345ebe820b74393d538f1143092994389d7f20bf0b395c78d16307b242c801e6077f

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrli:86SIROiFJiwp0xlrli

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2