Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ebed485b42c0524c09fc9a6b63ed6d17_JaffaCakes118

  • Size

    121KB

  • Sample

    240919-wx25gasgnb

  • MD5

    ebed485b42c0524c09fc9a6b63ed6d17

  • SHA1

    ae7ab009bdf62acd8cbe4661839c45bae847436a

  • SHA256

    cadf58a40041cdbdac68b02e259d45310985ae8b236ce04211da5316d108094d

  • SHA512

    715900554fa4e73fe66bbd09bb2955072da57ba50a789caff27d2fb502fef7709297a5065687941e02c6cfb6efce78a9bc4fc07ef5c1baff62dd3aa2b7463296

  • SSDEEP

    3072:kQSkOYWUb7pYrlBnqn387MW3ytmk5KMUOK/Ye7:3SkOra1YRBq3QRCEu4OKd

Malware Config

Extracted

Family

pony

C2

http://178.77.99.145:8080/pony/gate.php

http://49.156.20.209:8080/pony/gate.php

Attributes
  • payload_url

    http://ftp.mebel4u.home.pl/9kEg3oB.exe

    http://www.lovetaoyuan.com/v7a47NA.exe

Targets

    • Target

      ebed485b42c0524c09fc9a6b63ed6d17_JaffaCakes118

    • Size

      121KB

    • MD5

      ebed485b42c0524c09fc9a6b63ed6d17

    • SHA1

      ae7ab009bdf62acd8cbe4661839c45bae847436a

    • SHA256

      cadf58a40041cdbdac68b02e259d45310985ae8b236ce04211da5316d108094d

    • SHA512

      715900554fa4e73fe66bbd09bb2955072da57ba50a789caff27d2fb502fef7709297a5065687941e02c6cfb6efce78a9bc4fc07ef5c1baff62dd3aa2b7463296

    • SSDEEP

      3072:kQSkOYWUb7pYrlBnqn387MW3ytmk5KMUOK/Ye7:3SkOra1YRBq3QRCEu4OKd

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks