Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_76fed879b57508ca6b7ac4bc30e46a70
-
Size
137KB
-
Sample
250104-ckyrqsxram
-
MD5
76fed879b57508ca6b7ac4bc30e46a70
-
SHA1
6d604d92a04f2b473e5751785209341ff7e4b1e1
-
SHA256
53e3c396d6d1c693308f625a3e7105f2ae1fd498b560ae86558e7d2cb1d91451
-
SHA512
0d1cc903a564cc05c1f46d65ddb90ef86034b2563cc132878b9c75850bcb7656ce8c0134635cd54fb739104552e2c30177d21ef1276cf86244cab2d0501391e6
-
SSDEEP
3072:qlE7VW5APA3jaPPMnUwfy77SWEFk6KjmBt/6XLlO/05xv:yUVW5OdPyUwf87SWEFk6KjS6XL9xv
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_76fed879b57508ca6b7ac4bc30e46a70.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_76fed879b57508ca6b7ac4bc30e46a70.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
pony
http://mail.yaklasim.com:8080/forum/viewtopic.php
http://116.122.158.195:8080/forum/viewtopic.php
http://lifestylebonita.com/forum/viewtopic.php
http://lifestyleestero.com/forum/viewtopic.php
-
payload_url
http://ftp.licenter.org/f3G0.exe
http://173.192.39.2/6mzAfo.exe
http://fanpageserver.info/ngzRURp.exe
http://NEWFOREXTRAINING.COM/tyLMP.exe
Targets
-
-
Target
JaffaCakes118_76fed879b57508ca6b7ac4bc30e46a70
-
Size
137KB
-
MD5
76fed879b57508ca6b7ac4bc30e46a70
-
SHA1
6d604d92a04f2b473e5751785209341ff7e4b1e1
-
SHA256
53e3c396d6d1c693308f625a3e7105f2ae1fd498b560ae86558e7d2cb1d91451
-
SHA512
0d1cc903a564cc05c1f46d65ddb90ef86034b2563cc132878b9c75850bcb7656ce8c0134635cd54fb739104552e2c30177d21ef1276cf86244cab2d0501391e6
-
SSDEEP
3072:qlE7VW5APA3jaPPMnUwfy77SWEFk6KjmBt/6XLlO/05xv:yUVW5OdPyUwf87SWEFk6KjS6XL9xv
-
Pony family
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-