Extracted

• • Target

    e9536d05e505d0202c8865679cae75ad_JaffaCakes118

  • Size

    2.2MB

  • MD5

    e9536d05e505d0202c8865679cae75ad

  • SHA1

    df636ee9b518146301d2528ba0554004f0a01645

  • SHA256

    1fbeb089d33d82059a8f29d4d5464e6fd64e49bfaeef8a9ea91fed7104d59357

  • SHA512

    ee483378a7f873510c4a86fead3d82905a7ce0dd4c3bbb4c8e97f9454c9e323032a709cfd8f83792e474c9f0e1ea597fcaa9f7bde150002c9edc9b35da05abab

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWwwI

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2