Extracted

• • Target

    ec7f32eaabe5fbe2d12081d613ac3f71_JaffaCakes118

  • Size

    2.6MB

  • MD5

    ec7f32eaabe5fbe2d12081d613ac3f71

  • SHA1

    595064fe601b829b10f290c2d4f490efa492e254

  • SHA256

    6f772662b62008eb3be6ebffd656bd7bead5bbfb267dfdfc34b6474d3bb9a80c

  • SHA512

    fb539d3557665a6176ab7157a04eb86d44812db7348ee58060b67e0a4a8c504d5b0bb638f8fdd1f498d9347efcc8e05b79bb4a35536bbd6e2b6b8a144e18090a

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlc:86SIROiFJiwp0xlrlc

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2