Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    cbaed3295a7685538e08d755fb14ee02e5f8bd744466235bf31e3b339f5e4580

  • Size

    123KB

  • Sample

    221203-p9scgaff61

  • MD5

    c9ad027ff7f6b942e9607a34d2e8f5d3

  • SHA1

    497360fedbd7ab5ef3b8c8718825ae5f46bf07ec

  • SHA256

    cbaed3295a7685538e08d755fb14ee02e5f8bd744466235bf31e3b339f5e4580

  • SHA512

    ac722ca6811d07ed9671601abfc1c05fc116060103007c0cee3aceba912e7b226900cba7d0a2f1f6a09b3a4ff29e52d3860611a56f8f5229564b8392aeb24f24

  • SSDEEP

    3072:1Fe3LP9WlKcNPyDSQV87RCnqdRBuRqvRIZ78ZN5V:16glK+PyOQV05disRI2N

Malware Config

Targets

    • Target

      cbaed3295a7685538e08d755fb14ee02e5f8bd744466235bf31e3b339f5e4580

    • Size

      123KB

    • MD5

      c9ad027ff7f6b942e9607a34d2e8f5d3

    • SHA1

      497360fedbd7ab5ef3b8c8718825ae5f46bf07ec

    • SHA256

      cbaed3295a7685538e08d755fb14ee02e5f8bd744466235bf31e3b339f5e4580

    • SHA512

      ac722ca6811d07ed9671601abfc1c05fc116060103007c0cee3aceba912e7b226900cba7d0a2f1f6a09b3a4ff29e52d3860611a56f8f5229564b8392aeb24f24

    • SSDEEP

      3072:1Fe3LP9WlKcNPyDSQV87RCnqdRBuRqvRIZ78ZN5V:16glK+PyOQV05disRI2N

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks