Extracted

• • Target

    f49a62668cb8dad24b05a0d43dc56b87_JaffaCakes118

  • Size

    2.2MB

  • MD5

    f49a62668cb8dad24b05a0d43dc56b87

  • SHA1

    48ed2574f4058bd4cca55ae795f6bed40f94c38b

  • SHA256

    8e8af455a47a7dabd96bd941155b471ecf807976c08ab624db3601c6ed1fa97b

  • SHA512

    0b7395f1bfd628febff79bb61543c43d446443be902f5440cfc9be1fb7136b34d2f99e1171a5ba61049fa11d3a74f6e07b28ecf48266202f9c14cae7cfe56a81

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZY:0UzeyQMS4DqodCnoe+iitjWwwE

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2