Extracted

• • Target

    e97df2e60e419c8d5cc712de089ac6a0_JaffaCakes118

  • Size

    2.2MB

  • MD5

    e97df2e60e419c8d5cc712de089ac6a0

  • SHA1

    c926ed932af38c84e070b4a7887429f0501faeb8

  • SHA256

    7c2e7e09d3d5d6a167355465ceb73e1f3f13665a0a6a578939ceb8ae00b60c3c

  • SHA512

    22a42be385a2d2a0328c1489ffe0e464c6e2f23439efe90ed93dcf100f068105d2680d0416833fad578fb1dfb49fa0929f9867dd65e034f14b92ca5f4fd78d69

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZd:0UzeyQMS4DqodCnoe+iitjWww5

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2