Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6f7f549cc129824283a402180c348073daee1eecfb00805156e3013f78390523.exe

  • Size

    1.3MB

  • Sample

    240808-bqzesa1epa

  • MD5

    8d0c8a3b94084a3819ef0e20da6fd419

  • SHA1

    32c9f90cee9c0c8a92295bc297dabd22b807f2a8

  • SHA256

    6f7f549cc129824283a402180c348073daee1eecfb00805156e3013f78390523

  • SHA512

    3c39c8908b77f537a0812522d7cf51bb38b07ac7435291a78d1fceff14116f944b085dfce3c3f6cee73336663ae7823d6569e0ebf9905d2c4b658b32a06e1e4f

  • SSDEEP

    24576:wRmJkcoQricOIQxiZY1Ha4IfVwFVQsakAmvdVxeLi4:FJZoQrbTFZY1HaHfV2DAUn4

Malware Config

Extracted

Family

pony

C2

http://mpsound.eu/slimbox/panelnew/gate.php

Attributes
  • payload_url

    http://mpsound.eu/slimbox/panelnew/pony.exe

Targets

    • Target

      6f7f549cc129824283a402180c348073daee1eecfb00805156e3013f78390523.exe

    • Size

      1.3MB

    • MD5

      8d0c8a3b94084a3819ef0e20da6fd419

    • SHA1

      32c9f90cee9c0c8a92295bc297dabd22b807f2a8

    • SHA256

      6f7f549cc129824283a402180c348073daee1eecfb00805156e3013f78390523

    • SHA512

      3c39c8908b77f537a0812522d7cf51bb38b07ac7435291a78d1fceff14116f944b085dfce3c3f6cee73336663ae7823d6569e0ebf9905d2c4b658b32a06e1e4f

    • SSDEEP

      24576:wRmJkcoQricOIQxiZY1Ha4IfVwFVQsakAmvdVxeLi4:FJZoQrbTFZY1HaHfV2DAUn4

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Accesses cryptocurrency files/wallets, possible credential harvesting

MITRE ATT&CK Enterprise v15

Tasks