Extracted

• • Target

    f4723699f69126b5354c52a565eb68b4_JaffaCakes118

  • Size

    2.6MB

  • MD5

    f4723699f69126b5354c52a565eb68b4

  • SHA1

    18b7cdda0cf804ec365ae6c534c530b868aeb1fb

  • SHA256

    5cc9864cfee2bc70091b1e2a4c256ef4ea7391cbdae1da4363d6b89a3f69879c

  • SHA512

    2e5fb46923a14afce8ae0a34a07f0ec72a7ca69480e07b3d49597152c2600df85b547c21d74e2b83ce98f033951a3441b65e034328b33d7211e3a97c7f5dbd87

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlB:86SIROiFJiwp0xlrlB

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2