Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d579a8bba252bf0a5bd698a7e0a95130.exe

  • Size

    88KB

  • Sample

    240912-x5h71azfkq

  • MD5

    d579a8bba252bf0a5bd698a7e0a95130

  • SHA1

    b1510a4940a7710e27c6b81963a66965d1994627

  • SHA256

    95d4eca45056b0abfd6f8bb5cd05d5c30d25c1e7be9e2a3104b6a399939ef226

  • SHA512

    8e7fb2b551f3d7b3576b390513c2b5a7bca7fc3ce1b042f33e23b155e0d47d478029d0ee583b8905cfd873e81a7ab219ffff909c9284746ec33521554b1e3799

  • SSDEEP

    1536:x3V3e8KytqTZkYu5SCvaDBzgM+5zu9kS24zxAkOg8WTvMEIGkzZ3:9dOy+ubiDBzv+1H4OgYEIJ3

Malware Config

Extracted

Family

pony

C2

http://www4.mafia2.co.nu/default.php?2frheGrNK89IUvOLmxrKavncv8rkxM6s3k

http://soarcard02.com/default.php?PO2SRhs6h5ya1FDDLvpYw4Ywpnx8StSKVjIpC

http://idca2011.com/default.php?BPAu5yL4mGGkdnvdfv8NVYKJBVG69PFrlwiwONm

http://tanincamera.com/default.php?qP5wxR89Y8jcsSCQBumO9GOIfn3UGKaVwxPx

http://at206.jlink.co.uk/default.php?Nn9QWfhPcrpvFU8jRN8UNXo1IaVlrzHQVN

Targets

    • Target

      d579a8bba252bf0a5bd698a7e0a95130.exe

    • Size

      88KB

    • MD5

      d579a8bba252bf0a5bd698a7e0a95130

    • SHA1

      b1510a4940a7710e27c6b81963a66965d1994627

    • SHA256

      95d4eca45056b0abfd6f8bb5cd05d5c30d25c1e7be9e2a3104b6a399939ef226

    • SHA512

      8e7fb2b551f3d7b3576b390513c2b5a7bca7fc3ce1b042f33e23b155e0d47d478029d0ee583b8905cfd873e81a7ab219ffff909c9284746ec33521554b1e3799

    • SSDEEP

      1536:x3V3e8KytqTZkYu5SCvaDBzgM+5zu9kS24zxAkOg8WTvMEIGkzZ3:9dOy+ubiDBzv+1H4OgYEIJ3

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.