Extracted

• • Target

    7144553378cbcec603969ea843728ba1a088d6ea043eb240d89ad5328285aac9N

  • Size

    2.6MB

  • MD5

    8d62dabf25ee59fd02033ededf676fd0

  • SHA1

    919f4e67b184904b352a09f9e4a77e88f67e85b5

  • SHA256

    7144553378cbcec603969ea843728ba1a088d6ea043eb240d89ad5328285aac9

  • SHA512

    f753745c8991de22435ffe73f8c89f7e722c225065f2e78397eabaa7bdcdb83304b9db4cf59427de83b649edf141e61076a6b3d593954ff622b08f151a437e58

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlC:86SIROiFJiwp0xlrlC

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2