Extracted

• • Target

    ef7eda74d0b5fab0b816c8f5a8e8434d_JaffaCakes118

  • Size

    2.6MB

  • MD5

    ef7eda74d0b5fab0b816c8f5a8e8434d

  • SHA1

    5a3cb014eb3eb75354440ace5fc56d784e0ae7c4

  • SHA256

    ce9d09658d944324e9067f6cc3cca7fc305217c9718cc0d2c71b6b3e428fa433

  • SHA512

    c9941c008cdc67c0f9a1c5c1fb7c1b52ec4f586e33d0b6ac0281b860f2310617c3d9d860b45dc67d757aec0c0ca81bc77e9794304815196cb1d1338a2263514c

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlJ:86SIROiFJiwp0xlrlJ

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2