Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d0d7fd3200a043846af1bbb6ea4d9f3adeaa5fff12ddd8dd2e9bda227fbc6f9a

  • Size

    118KB

  • Sample

    221029-1t5hmshedr

  • MD5

    55809f2f1bf70d1bcdb5b16c0d156120

  • SHA1

    10fc43992096f1b1d9caace3d76f2c5081ed4f63

  • SHA256

    d0d7fd3200a043846af1bbb6ea4d9f3adeaa5fff12ddd8dd2e9bda227fbc6f9a

  • SHA512

    995a244ceb2a0e7a4aa1512b678081a944251790cac7fe27fc417d8911c0edad709332618c458f478928999795944b093de215a2f6377b1861d3e61d2d5f6f8f

  • SSDEEP

    3072:Cq2oEdA7BI3FsSQXOGwtQInJLBH5uLey:CcI36SQeGgJVQLey

Malware Config

Extracted

Family

pony

C2

http://associationanywhere.mobi/ponyb/gate.php

http://associationcaddie.com/ponyb/gate.php

http://avodigy.mobi/ponyb/gate.php

http://avodigy.net/ponyb/gate.php

Attributes
  • payload_url

    http://fotostudio-mahlsdorf.de/8UWQe.exe

    http://ftp.ppp.at/MhCSKv.exe

    http://207.204.14.122/DSH.exe

    http://salsaconfuego.com/RCY.exe

Targets

    • Target

      d0d7fd3200a043846af1bbb6ea4d9f3adeaa5fff12ddd8dd2e9bda227fbc6f9a

    • Size

      118KB

    • MD5

      55809f2f1bf70d1bcdb5b16c0d156120

    • SHA1

      10fc43992096f1b1d9caace3d76f2c5081ed4f63

    • SHA256

      d0d7fd3200a043846af1bbb6ea4d9f3adeaa5fff12ddd8dd2e9bda227fbc6f9a

    • SHA512

      995a244ceb2a0e7a4aa1512b678081a944251790cac7fe27fc417d8911c0edad709332618c458f478928999795944b093de215a2f6377b1861d3e61d2d5f6f8f

    • SSDEEP

      3072:Cq2oEdA7BI3FsSQXOGwtQInJLBH5uLey:CcI36SQeGgJVQLey

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks