Extracted

• • Target

    e9c9506aebeb4aa520bda57d20c66350_JaffaCakes118

  • Size

    2.6MB

  • MD5

    e9c9506aebeb4aa520bda57d20c66350

  • SHA1

    b9178dfffc925112584844af8dbbbfa07d437477

  • SHA256

    dfca70ba51fbdedb54a9cd4a31942c6861ea130b11e69b7fae3bb455b13d9165

  • SHA512

    06144d293b5ecd36cd0c8586690e826a91054a31009328b9b45a1604e5d5b6a7dd77ddd6747ea19621eeed15f88dcab33017747931c9fe9c6b7062ba27dc5771

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrly:86SIROiFJiwp0xlrly

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2