Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    276fc8b4dd6bb964ae4aec3e310ec706_JaffaCakes118

  • Size

    133KB

  • Sample

    241009-ab54ca1dpl

  • MD5

    276fc8b4dd6bb964ae4aec3e310ec706

  • SHA1

    20a64dfaf315bd7c3907b66ecfa772a0739e90ba

  • SHA256

    b53d4dd3ee4175f4b8dc71c6dd536407335a43e1469c0a5992455bfd2e88df52

  • SHA512

    94ff82697a8d3f4df2115c317291c82df5cfeb581e9641cd7b69407127225d8dff71954dbef4a4f6a65af63b5808f82900a485588fa511c189e16d247589cf45

  • SSDEEP

    3072:K+ahUFU2xiEb4ievJJoa600Wgls48UY5o:KdS9r4JJz600WgpQS

Malware Config

Extracted

Family

pony

C2

http://192.155.83.208/forum/viewtopic.php

http://74.91.117.64/forum/viewtopic.php

Attributes
  • payload_url

    http://www.heimes-fenster.de/Asi9Q.exe

    http://lugeck-berchtesgaden.de/1Hp3xcx6.exe

    http://amg-unipessoal.pt/0TNzD1b0.exe

Targets

    • Target

      276fc8b4dd6bb964ae4aec3e310ec706_JaffaCakes118

    • Size

      133KB

    • MD5

      276fc8b4dd6bb964ae4aec3e310ec706

    • SHA1

      20a64dfaf315bd7c3907b66ecfa772a0739e90ba

    • SHA256

      b53d4dd3ee4175f4b8dc71c6dd536407335a43e1469c0a5992455bfd2e88df52

    • SHA512

      94ff82697a8d3f4df2115c317291c82df5cfeb581e9641cd7b69407127225d8dff71954dbef4a4f6a65af63b5808f82900a485588fa511c189e16d247589cf45

    • SSDEEP

      3072:K+ahUFU2xiEb4ievJJoa600Wgls48UY5o:KdS9r4JJz600WgpQS

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks