Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f44f5f354455ef4a0673f458c928ec3c_JaffaCakes118

  • Size

    190KB

  • Sample

    240924-xqj6rashre

  • MD5

    f44f5f354455ef4a0673f458c928ec3c

  • SHA1

    1c4ec04751eb0cbc697d617baedd5a29ab82732f

  • SHA256

    06ecee129893b726cb0bf69db556d69efa2ec00c43e687008da79b8292a1a506

  • SHA512

    be30b83aa55dd56e5f05852c782e5cf96eb94e504b421bee349ee3100fd2568f7316fb877458ed16267b417484a7beef62b060cc533fe39e4f0499fdd953d419

  • SSDEEP

    3072:DydWBSPjeY3wZhwTtWt6vHW+ZbYibWcxu+o230SW:DyEM1AZChWt6vLX9oeA

Malware Config

Extracted

Family

pony

C2

http://classicmodels.at:8080/forum/viewtopic.php

http://diva-code.at:8080/forum/viewtopic.php

Attributes
  • payload_url

    http://cebuestatehub.com/6cMmTG2.exe

    http://www.billmann.talktalk.net/8FAk.exe

    http://wibawo.de/M16an5.exe

Targets

    • Target

      f44f5f354455ef4a0673f458c928ec3c_JaffaCakes118

    • Size

      190KB

    • MD5

      f44f5f354455ef4a0673f458c928ec3c

    • SHA1

      1c4ec04751eb0cbc697d617baedd5a29ab82732f

    • SHA256

      06ecee129893b726cb0bf69db556d69efa2ec00c43e687008da79b8292a1a506

    • SHA512

      be30b83aa55dd56e5f05852c782e5cf96eb94e504b421bee349ee3100fd2568f7316fb877458ed16267b417484a7beef62b060cc533fe39e4f0499fdd953d419

    • SSDEEP

      3072:DydWBSPjeY3wZhwTtWt6vHW+ZbYibWcxu+o230SW:DyEM1AZChWt6vLX9oeA

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks