Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f6a367ef52912a7d9dfeeed8599b20ab_JaffaCakes118

  • Size

    95KB

  • Sample

    240925-xelkfa1eln

  • MD5

    f6a367ef52912a7d9dfeeed8599b20ab

  • SHA1

    7eca5112014e494185c4d135101a0668aa5dc2a1

  • SHA256

    744aad3023b1b20bb526325d16c8614d06e0e0240c2fd6711c0d61727ef9fd6e

  • SHA512

    5278aa3e252193df88900205dd92a6fd11469130977762e018b66ff8e3a17c48841d36cde4bf71e880dd61a7fbf567c0753d8c9f2e81b2a7321e6d03d332c3a6

  • SSDEEP

    1536:0SZQ4mljsBU6vO6a4f83c4RPemig/UugYA7TNeHQFqkdQiIwCP4:Dl1jTa4f83coPB/X/8TNVF7d3IwCP4

Malware Config

Extracted

Family

pony

C2

http://88.85.99.44:8080/pony/gate.php

http://91.121.140.103:8080/pony/gate.php

http://91.121.178.156:8080/pony/gate.php

Attributes
  • payload_url

    http://projektvitalis.bplaced.net/KdLuEnNZ.exe

    http://gnarlybuys.info/LMbir.exe

    http://100s.pl/jQnoeUC.exe

    http://www.imobiliariacruzeirors.com.br/hEh0R.exe

Targets

    • Target

      f6a367ef52912a7d9dfeeed8599b20ab_JaffaCakes118

    • Size

      95KB

    • MD5

      f6a367ef52912a7d9dfeeed8599b20ab

    • SHA1

      7eca5112014e494185c4d135101a0668aa5dc2a1

    • SHA256

      744aad3023b1b20bb526325d16c8614d06e0e0240c2fd6711c0d61727ef9fd6e

    • SHA512

      5278aa3e252193df88900205dd92a6fd11469130977762e018b66ff8e3a17c48841d36cde4bf71e880dd61a7fbf567c0753d8c9f2e81b2a7321e6d03d332c3a6

    • SSDEEP

      1536:0SZQ4mljsBU6vO6a4f83c4RPemig/UugYA7TNeHQFqkdQiIwCP4:Dl1jTa4f83coPB/X/8TNVF7d3IwCP4

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks