Extracted

• • Target

    e7732990170be5738613b081d43ec92b_JaffaCakes118

  • Size

    2.2MB

  • MD5

    e7732990170be5738613b081d43ec92b

  • SHA1

    8d8e9db0f3d7016df8c9c38b644401bf4226f911

  • SHA256

    65849cbe6ab30245f5b3079399d81a215556cb50b7a0b53c83974d12bd3ee2e9

  • SHA512

    78093d48c49040d4963a21f075e3031ac79050fc5b81289fb74d7aeae659e6370fd16676fab38bbc38788e415f7d54d225881869eb897d7f84731586c3d59b3a

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ8:0UzeyQMS4DqodCnoe+iitjWww4

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2