Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d861956d534c059de895c59cc0cfcde6_JaffaCakes118

  • Size

    128KB

  • Sample

    240910-rs973axfjp

  • MD5

    d861956d534c059de895c59cc0cfcde6

  • SHA1

    6a8c5e5f6b6b51e98bdae96e7ae1c115e77e9da4

  • SHA256

    022fb82ef3d35b42dfe25634ea9001e1e542f6c1aab547580cc54b557264bcb9

  • SHA512

    054792b7a790477dfa5f813614028fc9b14bb0b6874aaa104e060edf432dcffca70de550c2363f05d39186457989d9ba39c6da791f2d24a4865eae9ab97b0b6d

  • SSDEEP

    3072:uGHi6mwKfjNHsXJNYxHWPKBV4ENNCDjraVDAEmJI:+ZfjOXJSxH54ENMjr+DAE

Malware Config

Extracted

Family

pony

C2

http://67.215.225.205:8080/forum/viewtopic.php

http://216.231.139.111/forum/viewtopic.php

Attributes
  • payload_url

    http://ftp.approachit.com/jZy.exe

    http://atualizacoes.issqn.net/FhPD.exe

    http://tokulances.sitebr.net/jV1.exe

Targets

    • Target

      d861956d534c059de895c59cc0cfcde6_JaffaCakes118

    • Size

      128KB

    • MD5

      d861956d534c059de895c59cc0cfcde6

    • SHA1

      6a8c5e5f6b6b51e98bdae96e7ae1c115e77e9da4

    • SHA256

      022fb82ef3d35b42dfe25634ea9001e1e542f6c1aab547580cc54b557264bcb9

    • SHA512

      054792b7a790477dfa5f813614028fc9b14bb0b6874aaa104e060edf432dcffca70de550c2363f05d39186457989d9ba39c6da791f2d24a4865eae9ab97b0b6d

    • SSDEEP

      3072:uGHi6mwKfjNHsXJNYxHWPKBV4ENNCDjraVDAEmJI:+ZfjOXJSxH54ENMjr+DAE

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.