Extracted

• • Target

    fe2ad43776b344677d480ecc6014be6e_JaffaCakes118

  • Size

    2.2MB

  • MD5

    fe2ad43776b344677d480ecc6014be6e

  • SHA1

    7625d13064abf9f5976a11a8ef023ddd138d3a0d

  • SHA256

    f85365d18e20d385ece1d9534da2f903efa68fe118cfd128c2251d5d44196248

  • SHA512

    6d336111c8dd465cf9276dfcb56a4938c80b67f915c782ba0a9197f5a9415207b19804fda9fbf7c32a5aa4ccc14c0b9279a2bee5554db46f4494e43e82c378e2

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZr:0UzeyQMS4DqodCnoe+iitjWwwP

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2