Extracted

• • Target

    ed1dbfe2ab4bbc27c674687625b05a81_JaffaCakes118

  • Size

    2.6MB

  • MD5

    ed1dbfe2ab4bbc27c674687625b05a81

  • SHA1

    aaa587bfea4849c4b6ee84fb9b824c4db7a234e8

  • SHA256

    0a69ad4a8840f337da104bab8c96d8fb0f4d9b89f3586802ab9f41ea858cc0e8

  • SHA512

    2131c5611880047f7e4809d3ec88885bdf71c785ba24d4138287270601d0bb279caa6abbf555c1ab2010dcfd6befe0058bdad2f9ceadb617c83e73f881d85ed9

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrly:86SIROiFJiwp0xlrly

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2