Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
fa65e91f0a5f117e4da666eda74c7dbf9ff7fe70ea4477bcd0089060b6687e5b
-
Size
291KB
-
Sample
221205-xkc59afd74
-
MD5
2e112395a64b710c83b4fbcf5d53cf52
-
SHA1
e6930f33beadce15b76f10c47d226a1acb622ba0
-
SHA256
fa65e91f0a5f117e4da666eda74c7dbf9ff7fe70ea4477bcd0089060b6687e5b
-
SHA512
a03d2e5cbddd04636e8476d96be24ce482a4557e322f03ae0a3e63fe06f76f03e1578277c37d38d2c20e2250e724a042cb2beba0c0eac6661608c43c1af9c161
-
SSDEEP
6144:9/KudswtwoZVJ+pr2uGwbUr5YrfwMDcIIYC:9FdT/VJ0rzGwb2irIMDcIIYC
Malware Config
Targets
-
-
Target
fa65e91f0a5f117e4da666eda74c7dbf9ff7fe70ea4477bcd0089060b6687e5b
-
Size
291KB
-
MD5
2e112395a64b710c83b4fbcf5d53cf52
-
SHA1
e6930f33beadce15b76f10c47d226a1acb622ba0
-
SHA256
fa65e91f0a5f117e4da666eda74c7dbf9ff7fe70ea4477bcd0089060b6687e5b
-
SHA512
a03d2e5cbddd04636e8476d96be24ce482a4557e322f03ae0a3e63fe06f76f03e1578277c37d38d2c20e2250e724a042cb2beba0c0eac6661608c43c1af9c161
-
SSDEEP
6144:9/KudswtwoZVJ+pr2uGwbUr5YrfwMDcIIYC:9FdT/VJ0rzGwb2irIMDcIIYC
Score10/10-
Modifies security service
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE
-
Modifies Installed Components in the registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-