Extracted

• • Target

    ee5648b51b1c20fc738ec65424f90fc3_JaffaCakes118

  • Size

    2.6MB

  • MD5

    ee5648b51b1c20fc738ec65424f90fc3

  • SHA1

    9413dfdd305417bd532d0f9ba412b766b64c9c2d

  • SHA256

    40dfb1079a12529a7cf7da67c703f25c92b7c71050a7c434f4d7904ccb0dc5e3

  • SHA512

    05b0a53f8434c38375a390d5ac71df32b0724bc9bae1f3424f9f25c51eb5c2eec98871e4a313a918e6c644622280d1ea0256d150d5c387dd00cddd58c54d5129

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrltKKKKKKKKKKKKKKKKKKKKKKE:86SIROiFJiwp0xlrltKKKKKKKKKKKKKl

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2