Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a2bf3dd56fbaf2c85f2c35943aba4b81c50c3f48f40ffb3016ebf3c61185c2d9

  • Size

    128KB

  • Sample

    241208-b3n5ksvpgs

  • MD5

    cd8b637465c0a482d0cd6e15ba5fb147

  • SHA1

    d2075a7587268721e06aadd40a36562203b4d1d9

  • SHA256

    a2bf3dd56fbaf2c85f2c35943aba4b81c50c3f48f40ffb3016ebf3c61185c2d9

  • SHA512

    0dddf67a04c16fba798bfd90e047e48c3f8a833e14a46cebc0edf50905ac5d7496713e3066b3ae9b73398f02f3f3adfa31a65894780f08caee9f4a96c6a0ac78

  • SSDEEP

    3072:uGHi6mwSpIZsgDQqUsDWveXhMbIiDL6jjrZsJI:+1pPgDQqUGwfIYqjr

Malware Config

Extracted

Family

pony

C2

http://67.215.225.205:8080/forum/viewtopic.php

http://69.194.193.134/forum/viewtopic.php

Attributes
  • payload_url

    http://barna-consulting.info/bsnCqdm3.exe

    http://ftp.spaziometi.org/nPgqe.exe

    http://besnirehber.com/dsZMdBNc.exe

Targets

    • Target

      a2bf3dd56fbaf2c85f2c35943aba4b81c50c3f48f40ffb3016ebf3c61185c2d9

    • Size

      128KB

    • MD5

      cd8b637465c0a482d0cd6e15ba5fb147

    • SHA1

      d2075a7587268721e06aadd40a36562203b4d1d9

    • SHA256

      a2bf3dd56fbaf2c85f2c35943aba4b81c50c3f48f40ffb3016ebf3c61185c2d9

    • SHA512

      0dddf67a04c16fba798bfd90e047e48c3f8a833e14a46cebc0edf50905ac5d7496713e3066b3ae9b73398f02f3f3adfa31a65894780f08caee9f4a96c6a0ac78

    • SSDEEP

      3072:uGHi6mwSpIZsgDQqUsDWveXhMbIiDL6jjrZsJI:+1pPgDQqUGwfIYqjr

    • Pony family

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses Microsoft Outlook accounts

    • Accesses Microsoft Outlook profiles

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.