Extracted

• • Target

    aa515a4e561d55f11264f281a8ebf0a1e9ebb4969263bbf0cdde898f80486e6aN

  • Size

    2.6MB

  • MD5

    945cadf741ece0c3ac011eaa6e8440a0

  • SHA1

    10c6d2d2d6633b02b0ac56ce1aa5bbd2a316f5d6

  • SHA256

    aa515a4e561d55f11264f281a8ebf0a1e9ebb4969263bbf0cdde898f80486e6a

  • SHA512

    1bb7277bda93fc4a036aad932541dff859fc4399b06c8bdaae69b34e90e6e2dd282679cee7af68ee7f4d4b9db69ff4d04a3a0836f89fc80299025db2ad03a9da

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlg:86SIROiFJiwp0xlrlg

  Score

  10^/10

  ponydiscoveryevasionpersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2