Extracted

• • Target

    eee13742556767677083a3a82b81c257_JaffaCakes118

  • Size

    2.2MB

  • MD5

    eee13742556767677083a3a82b81c257

  • SHA1

    7a410117035918ae251e1d8232ef04708ac23094

  • SHA256

    0c6602634661d7b3d3c3269a9d02599724a6366bc58ce2a40d08ed91b788736e

  • SHA512

    4b3d6b3631c58a087e22c0c94ff87c5a3200bdb3bf18f2332181f542fcde605210bd37d02bc9f583aac93f12998a5183a6243f56570fc086ae9a80d0773d3387

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZE:0UzeyQMS4DqodCnoe+iitjWww4

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2