Extracted

• • Target

    f65118cc62c7b37842bb659081c0d479_JaffaCakes118

  • Size

    2.2MB

  • MD5

    f65118cc62c7b37842bb659081c0d479

  • SHA1

    cc0c975082328bdc20c0aecf657acbf0a9284e0d

  • SHA256

    f65709b8b6c5ad5cbdb6cc418fbc0f009c4399866bae60d65dd9fd8afe07a521

  • SHA512

    3202deef8f65ee9b93356cc39b76c22788963a0fab732b92034174dfba1d4121c38dc44fddd131bde7fc22236d80e32b83b4ca28ef2dbba98e7d6984b5a7c91b

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZB:0UzeyQMS4DqodCnoe+iitjWwwF

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2