Extracted

• • Target

    ecbeeec4c77bc6cca5bc9b4d8338486e_JaffaCakes118

  • Size

    2.6MB

  • MD5

    ecbeeec4c77bc6cca5bc9b4d8338486e

  • SHA1

    14d610c9de647c16da00521d24de9026c6581e53

  • SHA256

    8fbbb62a0e939fafa523b14a7fc393c60ad06f14f6828dc861466d134e02d67c

  • SHA512

    3fd2ff036c72f83a63a17295e01f5fe3e438829a41ef65e8fa894ae5771ef7d72a386a852f4ffff0e36bfd8a379c18c9cc05df396cc8998261202ef127ba302b

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlB:86SIROiFJiwp0xlrlB

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2