Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
e89a03e73f12ec65040118c69b721c59_JaffaCakes118
-
Size
193KB
-
Sample
240408-2qjbnsea72
-
MD5
e89a03e73f12ec65040118c69b721c59
-
SHA1
980308df2d39e456c817215abcc335c9cf9333a4
-
SHA256
93e486554efa71e0da46388de32bc0be4c41948b18b4590990944bbc5344f868
-
SHA512
daa81389d1f8be7f1dec2b345f3b2ff764bcc83ab817d72754f990253537fb7437d463b0be39d5b5fc15134a510a651df7bc8b23df13c1af45c79df40d800b1b
-
SSDEEP
3072:ALk395hYXJkjSUxWpWdlP926IYWls7QddsouZnpyM8HERlJciF2zM1DDF6Q:AQqqjSlpWdlPgkQgoBERciFj1HF6Q
Behavioral task
behavioral1
Sample
e89a03e73f12ec65040118c69b721c59_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e89a03e73f12ec65040118c69b721c59_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
201151922243.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
201151922243.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
2011519222254.exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
2011519222254.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
e89a03e73f12ec65040118c69b721c59_JaffaCakes118
-
Size
193KB
-
MD5
e89a03e73f12ec65040118c69b721c59
-
SHA1
980308df2d39e456c817215abcc335c9cf9333a4
-
SHA256
93e486554efa71e0da46388de32bc0be4c41948b18b4590990944bbc5344f868
-
SHA512
daa81389d1f8be7f1dec2b345f3b2ff764bcc83ab817d72754f990253537fb7437d463b0be39d5b5fc15134a510a651df7bc8b23df13c1af45c79df40d800b1b
-
SSDEEP
3072:ALk395hYXJkjSUxWpWdlP926IYWls7QddsouZnpyM8HERlJciF2zM1DDF6Q:AQqqjSlpWdlPgkQgoBERciFj1HF6Q
Score10/10-
Gh0st RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
-
-
Target
201151922243.exe
-
Size
25.1MB
-
MD5
2f30d031eceaa35e41d78363747f9182
-
SHA1
c5d467e10167330cdc5c4d859a81ffdd0c1ac101
-
SHA256
52ab1dfca531c1b409af062478f1926d86fec266fe1c90a61c70676633cef8a5
-
SHA512
b4729afc5910f8b37ef0b5a2591b52b13da5fd0d259ef8f5af1e798f71c9630d9b004dca8301b5d7a820d516d86ddc198ae52eb43a22edc1a73a1a830bd9c71d
-
SSDEEP
3072:ALk395hYXJ708xqm3AdPSNtQ0SH54TiQgIwNxHv/YZzwCrddCnIsJBXc:AQqB00R3AdYbOUoIwNlnDCrddCxdc
Score10/10-
Gh0st RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
-
-
Target
2011519222254.exe
-
Size
308KB
-
MD5
a8247344600b8cdf4f8debe3c8493ba8
-
SHA1
bbc3ac5475dcdb16c4f38a180dbefb8dcefce4d0
-
SHA256
639cbbed21a4c8cbf9d63ef3952fdc0078a816e4703b2c91557dce082d7d0063
-
SHA512
cfa753ae805fd21db0fd1fea23f65b59173c589c77ea5fd73a9471647751c82d3d6d3d08f2a92a056a3e13f13fc93e8e9eb88fb5dd79d008232a27badfa994dd
-
SSDEEP
6144:yiTtiWB0wL7t9J5Gp34EnBC4G7v4G7AWF5:5XB0wd9rGN7BEJAi
Score10/10-
Gh0st RAT payload
-
Adds Run key to start application
-