Extracted

• • Target

    f5a8e02951cc3c7077d59191a87c14a2_JaffaCakes118

  • Size

    2.6MB

  • MD5

    f5a8e02951cc3c7077d59191a87c14a2

  • SHA1

    7ebb003cd3be5cc3381a87053b003227ab81fd5c

  • SHA256

    7fff98848e00f48e40ef3382c940ba80dce852a5e4c80efed9c45437528a1efa

  • SHA512

    918a8b5e020ba7a6115807938dd68615ca224c211b0dbd901a5e4dae5be8cfc2b085e3ff0816a7082d0a21d4bb31ed05b345bc14e2d928450f471dcb64b466dc

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlr:86SIROiFJiwp0xlrlr

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2