Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dc9823ca52167dd0a4c36cf6bb83d2fb_JaffaCakes118

  • Size

    102KB

  • Sample

    240912-tr5x3atcjd

  • MD5

    dc9823ca52167dd0a4c36cf6bb83d2fb

  • SHA1

    497d15532351a85eb0445db59586b4da9e7bae36

  • SHA256

    b57f9b9fa680fea2ddf54b3a83967ac9a64c6fa5a843f24aa5d98c6b87e4fa79

  • SHA512

    74b67dc70e030176b05f358f3528909ec560c7e027e2086dcdb54f50d9dfd1d8f486a73d7643ca17f88012289c5be59c7d352c45ce9afdfd8036efde7d853735

  • SSDEEP

    1536:TPwMM+D7tG0ES13Cu45tGiBWfmGimahDG1rp092KM486mZwdf1CklPoinfT1Arhy:3DxGY12p9NVsFC7u6moNCK4hy+Q

Malware Config

Extracted

Family

pony

C2

http://184.164.141.35/pony/gate.php

Attributes
  • payload_url

    http://alcaponecigarillos.com/RdKtpaU.exe

    http://freegermanpornsex.com/YiHVUjb.exe

    http://www.cuboderoda.com.br/vPhQ.exe

Targets

    • Target

      dc9823ca52167dd0a4c36cf6bb83d2fb_JaffaCakes118

    • Size

      102KB

    • MD5

      dc9823ca52167dd0a4c36cf6bb83d2fb

    • SHA1

      497d15532351a85eb0445db59586b4da9e7bae36

    • SHA256

      b57f9b9fa680fea2ddf54b3a83967ac9a64c6fa5a843f24aa5d98c6b87e4fa79

    • SHA512

      74b67dc70e030176b05f358f3528909ec560c7e027e2086dcdb54f50d9dfd1d8f486a73d7643ca17f88012289c5be59c7d352c45ce9afdfd8036efde7d853735

    • SSDEEP

      1536:TPwMM+D7tG0ES13Cu45tGiBWfmGimahDG1rp092KM486mZwdf1CklPoinfT1Arhy:3DxGY12p9NVsFC7u6moNCK4hy+Q

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.