Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    3519175e9e1bab229882cd7f52ceea3a_JaffaCakes118

  • Size

    190KB

  • Sample

    240710-rqxh7asgpk

  • MD5

    3519175e9e1bab229882cd7f52ceea3a

  • SHA1

    84c8df32d0c3c94e99bb2b36faa99bf5e68ef5b9

  • SHA256

    a4b1c1194ffdb1678a11b5c14e57dff235c8d8915a6c1cb70fa3863abdc2d971

  • SHA512

    277afa3ec635ae6c526dbfdd4a879342db1c458a5d6f32044d4fb525f8d802aec840be54f54c8d23c8b961bc427f38ebc3f467de33264399cf874944965aa7ab

  • SSDEEP

    3072:5oh5mHF1aoS/xBcOzTkl17bz+VY4NB+ae:Oh5fuzOjNK

Malware Config

Extracted

Family

pony

C2

http://etsiunjour.fr:81/pony/gate.php

http://69.194.194.238/pony/gate.php

Attributes
  • payload_url

    http://nuolaidos.lsas.lt/0HyztY.exe

    http://files-heaven.net/65rhQ.exe

Targets

    • Target

      3519175e9e1bab229882cd7f52ceea3a_JaffaCakes118

    • Size

      190KB

    • MD5

      3519175e9e1bab229882cd7f52ceea3a

    • SHA1

      84c8df32d0c3c94e99bb2b36faa99bf5e68ef5b9

    • SHA256

      a4b1c1194ffdb1678a11b5c14e57dff235c8d8915a6c1cb70fa3863abdc2d971

    • SHA512

      277afa3ec635ae6c526dbfdd4a879342db1c458a5d6f32044d4fb525f8d802aec840be54f54c8d23c8b961bc427f38ebc3f467de33264399cf874944965aa7ab

    • SSDEEP

      3072:5oh5mHF1aoS/xBcOzTkl17bz+VY4NB+ae:Oh5fuzOjNK

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.