Extracted

• • Target

    f1a3f9300fb02ac42c1358f77768dd48_JaffaCakes118

  • Size

    2.6MB

  • MD5

    f1a3f9300fb02ac42c1358f77768dd48

  • SHA1

    420b230442585b6f71cf4b8cbbdd15a3dbbac6c5

  • SHA256

    c3876faf3f98f6cfd318e71443fafac0634afb3b0aae66bc7ee85df34c3d0999

  • SHA512

    352bf4385bf2a16cab3e41f256cc19d36032cbb3a58ace0562f0dbb9c2a4d1e3956f731333d935bdf4ff87b4146869e083e82e07b9cab8f15cfffa292f8fb79f

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrly:86SIROiFJiwp0xlrly

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2