Extracted

• • Target

    f6e7a370a610708ca521782a0c4c8695_JaffaCakes118

  • Size

    2.6MB

  • MD5

    f6e7a370a610708ca521782a0c4c8695

  • SHA1

    bc02408e63825a635ff40efa291d3ab518b51149

  • SHA256

    59cfc8b651f5e72b8386e5a6762c6f818d35cd9ffea48fae6f05329d8f91a8df

  • SHA512

    4fa81e27af350cbd0403a2aa74d9bea483f85cf52db44d1f6403a2303496a0d3535f1302715e58414060c4bb60a140efed709337a886c81035a0c39bc06d7975

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrll:86SIROiFJiwp0xlrll

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2