Extracted

• • Target

    8c1947a4e551afe1fe6586fde418ed802670cf179d49b08677a0f70d00a6a4d9N

  • Size

    2.2MB

  • MD5

    44cc7d3fdcf0cc3c88c16bedebde2170

  • SHA1

    a25ca6bfaf84fc5c69fc9755fa15fd0506c079a8

  • SHA256

    8c1947a4e551afe1fe6586fde418ed802670cf179d49b08677a0f70d00a6a4d9

  • SHA512

    1ab86b5afa92d812e99beb0e09b84fde1e4027690269b1fc92f9a99c36516b9d4f2ee3b5a09b795277db2455da17b68d0aa3c714c05743f3a44a04955eb0967e

  • SSDEEP

    24576:0UzNkyrbtjbGixCOPKH2I1iIWILtfOIJ+HKodCHPC0cF3u7P1+eWQ8f/x52vHNZC:0UzeyQMS4DqodCnoe+iitjWwwm

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2