Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d47050fb24a731c6af2261dd210e2250_JaffaCakes118

  • Size

    108KB

  • Sample

    241208-a45chssrdy

  • MD5

    d47050fb24a731c6af2261dd210e2250

  • SHA1

    3ba7d3c08212984019a4ac2382fff0bf1e79a95f

  • SHA256

    20c34c9e3aef133305db41fab07b83a3ce107b2a9e742acab2d50dc659085c8d

  • SHA512

    cee5603486d1031c3e1e2f8adbdacd27f589b89e178a0008843330fbff5488754f0897982cd9cda073e3503f81be11c8486af322e6803aae8a9381e08b03f4b9

  • SSDEEP

    3072:M+bwYZAKSYC+H6CTcC5J3Cc1zSxYduxwhDTbkBqs1t:8YZ2T+H6A/3PduqdT4F

Malware Config

Extracted

Family

pony

C2

http://cityweddingguide.com:8080/pony/gate.php

http://200.72.183.54:81/pony/gate.php

Attributes
  • payload_url

    http://proyectoindio.org/7Qo.exe

    http://astronomika.com/493.exe

    http://12am.ro/0iZDFn1.exe

Targets

    • Target

      d47050fb24a731c6af2261dd210e2250_JaffaCakes118

    • Size

      108KB

    • MD5

      d47050fb24a731c6af2261dd210e2250

    • SHA1

      3ba7d3c08212984019a4ac2382fff0bf1e79a95f

    • SHA256

      20c34c9e3aef133305db41fab07b83a3ce107b2a9e742acab2d50dc659085c8d

    • SHA512

      cee5603486d1031c3e1e2f8adbdacd27f589b89e178a0008843330fbff5488754f0897982cd9cda073e3503f81be11c8486af322e6803aae8a9381e08b03f4b9

    • SSDEEP

      3072:M+bwYZAKSYC+H6CTcC5J3Cc1zSxYduxwhDTbkBqs1t:8YZ2T+H6A/3PduqdT4F

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks