Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    869fb02c7041c92d7ba4db41c7a07723d6a524301825ae45f69e35f07876b126

  • Size

    120KB

  • Sample

    221003-rhbxhsadh3

  • MD5

    6b983e73ce212288929ef59301c26570

  • SHA1

    1cdab2c85aa1786eb1c0aed064f10c6182dc7862

  • SHA256

    869fb02c7041c92d7ba4db41c7a07723d6a524301825ae45f69e35f07876b126

  • SHA512

    eba1387baa810e3f1a58dc057c84839337d6873da81f699b6a3f66580231676776a2ced17186b4b5a9faa5d83fff1622a2136ed21d0f9943141354b344d292eb

  • SSDEEP

    3072:CgarriqMEUduuQuIwmj2VsxZWogT4vxYncTNw16zN:aMndZzIwecUY0G6R

Malware Config

Extracted

Family

pony

C2

http://hybrid-repair.com/ponyz/gate.php

http://l89camaro.com/ponyz/gate.php

http://triandafilou.com/ponyz/gate.php

http://associationanywhere.mobi/ponyz/gate.php

Attributes
  • payload_url

    http://gallargues.architecture-signal.fr/6v9y.exe

    http://strassenbahn-bremen.de/DTf.exe

    http://63.135.102.191/n0t.exe

Targets

    • Target

      869fb02c7041c92d7ba4db41c7a07723d6a524301825ae45f69e35f07876b126

    • Size

      120KB

    • MD5

      6b983e73ce212288929ef59301c26570

    • SHA1

      1cdab2c85aa1786eb1c0aed064f10c6182dc7862

    • SHA256

      869fb02c7041c92d7ba4db41c7a07723d6a524301825ae45f69e35f07876b126

    • SHA512

      eba1387baa810e3f1a58dc057c84839337d6873da81f699b6a3f66580231676776a2ced17186b4b5a9faa5d83fff1622a2136ed21d0f9943141354b344d292eb

    • SSDEEP

      3072:CgarriqMEUduuQuIwmj2VsxZWogT4vxYncTNw16zN:aMndZzIwecUY0G6R

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks