Extracted

• • Target

    18edd607d0ba7c289c4023e9250941c6c0df6168c97865da83ed9329a38e8bc0N.exe

  • Size

    2.6MB

  • MD5

    5f637e755e1701eca25ad8d9ea088640

  • SHA1

    76713c766cd3865f6a2c0d26d1e5adbcda8dbad2

  • SHA256

    18edd607d0ba7c289c4023e9250941c6c0df6168c97865da83ed9329a38e8bc0

  • SHA512

    b1288f505e5264029528c244ad606284a432bfae49ed542774d9223eb128b72ae4c4fe2904d53658ed96a045c2700ece4e4bb3fccd10e982327d881720721aab

  • SSDEEP

    49152:8coQxSBeKeiOSiFmoJggggLo40KDi3gp0XhCjyrlN:86SIROiFJiwp0xlrlN

  Score

  10^/10

  ponydefense_evasiondiscoverypersistenceratspywarestealer

  • Modifies WinLogon for persistence

    persistence

  • Modifies visiblity of hidden/system files in Explorer

    defense_evasion

  • Pony family

    pony

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2