Extracted

• • Target

    816afd5495005f46db7cc37310fcac1d0ebfb67721aa48ea82224993922b9effN.exe

  • Size

    2.6MB

  • MD5

    d95ca30f44b0aca4eeb779d4e95d16e0

  • SHA1

    e08b1db3b52e7a7ca657fef5a3225f47b604fb07

  • SHA256

    816afd5495005f46db7cc37310fcac1d0ebfb67721aa48ea82224993922b9eff

  • SHA512

    de1b9478f9928e5380586909f56ba4c0cfafb4dd699c5438452a7990d64051b9b35c7ffe25e0021cd2347408e042e1a30a5032ab51478f5984fd7af3fbacc920

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrl0:86SIROiFJiwp0xlrl0

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2