Extracted

• • Target

    ee58140ea81cbf7c7de82c10071be1c0_JaffaCakes118

  • Size

    2.2MB

  • MD5

    ee58140ea81cbf7c7de82c10071be1c0

  • SHA1

    1f896d00e5d035b9e4768136ee2fa3303571cbbe

  • SHA256

    017259523232f6660d74d27f54fc83dcb5e516a205de171fc1418bd54d8735f3

  • SHA512

    c38bf03b39a0c3aa1d83714db410aadf9291646b9e86e4b4f9009c1dd48c0bacbf67ef89db28f97495958e358f692ee7c4c96d97f1d67ffb63f728d6367a31bd

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZu:0UzeyQMS4DqodCnoe+iitjWwwq

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2