Extracted

• • Target

    e823875c2d1c1de3931211a8c0849a4c_JaffaCakes118

  • Size

    2.2MB

  • MD5

    e823875c2d1c1de3931211a8c0849a4c

  • SHA1

    154f00d9449a4672f0f50b3bbd9d75fecda1caca

  • SHA256

    c2f67d88940583ed3a4c047895f762274b22132d53ffdebd149edc070f32a702

  • SHA512

    49b38f459b0fd2e2c607a82bc47b1137ad831e20d318049af8081b5fb154a70266ecf39ae3f3426f2bca4fe510d88e69564a32ae892ba789914b44132ea4212e

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZ8:0UzeyQMS4DqodCnoe+iitjWwww

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2