Extracted

• • Target

    7eef763674445904866b63ed0d19cca17e39713d9efb5c8855fcbbe481e9e0dcN.exe

  • Size

    2.6MB

  • MD5

    21fe5453e0cfae5568347f15675a9060

  • SHA1

    3da65d1e1972537bc7a5b72f260805a727e089ad

  • SHA256

    7eef763674445904866b63ed0d19cca17e39713d9efb5c8855fcbbe481e9e0dc

  • SHA512

    d9f4ce7193a9cf3e619d92dea82d65a1b402c23bae46d614ba55071d7f603c95b058c4cdeee6bbe5f113dc59b059a865166d3e00e34babe9855a4a3f07e69902

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlR:86SIROiFJiwp0xlrlR

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2