Extracted

• • Target

    ea86a661c75b5f20f4ec5e8760dc7be2_JaffaCakes118

  • Size

    2.2MB

  • MD5

    ea86a661c75b5f20f4ec5e8760dc7be2

  • SHA1

    bdc85c10651f988abcfcb6e2fe59f7ae1bb79d23

  • SHA256

    92e25bf21b40b3f5045dc0e2e4bac5fd78f2047572c3c75197a62b61395d6d56

  • SHA512

    42f61a67d5cdf18bb32953e6d8d9b82994e84a4cf5bbfd939956cf2c3106c1fdcee530ab83fc3c11c6e308b2926ca7d3b949aee0c9a70df2dd87a24135d007da

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZU:0UzeyQMS4DqodCnoe+iitjWww4

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2