Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3b754c5b6e...42.exe

windows7-x64

10

3b754c5b6e...42.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b754c5b6ecfd2f96b5adfda440717da7b027e316ce5b8052ffe7a61a5fd3742

  • Size

    118KB

  • Sample

    221030-qfsltachej

  • MD5

    a280a49d2de85b16a6c87f28e3810000

  • SHA1

    3897adf799f1620d339a3ce26ab24f5582f86986

  • SHA256

    3b754c5b6ecfd2f96b5adfda440717da7b027e316ce5b8052ffe7a61a5fd3742

  • SHA512

    161102891b2638d424290e0d961b198170b96260aa73a1891cda273e5650f3b9973831a8307f47eb47de2855cb271086a478053e041480422fff4bcb9a8dfe0f

  • SSDEEP

    3072:Ok+nL11Ivv29aZBKpxIfTKE2zTCWNh54x+hY:ZoL11IvvlB8iuY64M+

Score
10/10
ponycollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

pony

C2

http://mail.yaklasim.com:8080/forum/viewtopic.php

http://116.122.158.195:8080/forum/viewtopic.php

http://endsleepapnea.com/forum/viewtopic.php

http://iecho-mobility.com/forum/viewtopic.php
Attributes
  • payload_url

    http://dave.www.ontera.net/AUWY5Z.exe

    http://95.211.109.133/x2Goe.exe

    http://btganjramleelasamiti.com/ybXB.exe

    http://ftp.miniaturesbykim.com/mGji6vqG.exe

Targets

    • Target

      3b754c5b6ecfd2f96b5adfda440717da7b027e316ce5b8052ffe7a61a5fd3742

    • Size

      118KB

    • MD5

      a280a49d2de85b16a6c87f28e3810000

    • SHA1

      3897adf799f1620d339a3ce26ab24f5582f86986

    • SHA256

      3b754c5b6ecfd2f96b5adfda440717da7b027e316ce5b8052ffe7a61a5fd3742

    • SHA512

      161102891b2638d424290e0d961b198170b96260aa73a1891cda273e5650f3b9973831a8307f47eb47de2855cb271086a478053e041480422fff4bcb9a8dfe0f

    • SSDEEP

      3072:Ok+nL11Ivv29aZBKpxIfTKE2zTCWNh54x+hY:ZoL11IvvlB8iuY64M+

    Score
    10/10
    ponycollectiondiscoveryratspywarestealer

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

      ratspywarestealerpony

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks