Extracted

• • Target

    e6f75876a2f92b8e2844b4919ff5098c_JaffaCakes118

  • Size

    2.6MB

  • MD5

    e6f75876a2f92b8e2844b4919ff5098c

  • SHA1

    7373f1e9303d73b350340ebf3d4673dd18c610a0

  • SHA256

    cca2aeb3e338de01e42e2532a68491f14c11522d949d46034b2d0dadb85ebe04

  • SHA512

    9988577f3bb8df613c88b09ff40197f8296356e4ae4a212a68755f3d42fbdd0f7cebe2635bf3cfed7d6d2986d444821ecfe4ccdbfd8d29d8385cc1edf450063f

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl6:86SIROiFJiwp0xlrl6

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2