Extracted

• • Target

    f3cacece371a2aa95b8431c17a662411_JaffaCakes118

  • Size

    2.6MB

  • MD5

    f3cacece371a2aa95b8431c17a662411

  • SHA1

    7a934ab48b67d7e1d7778e97f9aac3aa7bbf33fe

  • SHA256

    85b9ef022a2482129b0876de18169558d3de1303f0b2d3ff4c284c2ffdc88e4b

  • SHA512

    f43d335929dabe0fc0fd4bfa4b5aad7bef9be635c619a9bb99a6869f8a90dbeae186a050e1872e1b26027d5a84d3a747ed5409d1c14a654faab970ba93c2bb16

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl8:86SIROiFJiwp0xlrl8

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2