Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e89a03e73f12ec65040118c69b721c59_JaffaCakes118

  • Size

    193KB

  • Sample

    240408-2qjbnsea72

  • MD5

    e89a03e73f12ec65040118c69b721c59

  • SHA1

    980308df2d39e456c817215abcc335c9cf9333a4

  • SHA256

    93e486554efa71e0da46388de32bc0be4c41948b18b4590990944bbc5344f868

  • SHA512

    daa81389d1f8be7f1dec2b345f3b2ff764bcc83ab817d72754f990253537fb7437d463b0be39d5b5fc15134a510a651df7bc8b23df13c1af45c79df40d800b1b

  • SSDEEP

    3072:ALk395hYXJkjSUxWpWdlP926IYWls7QddsouZnpyM8HERlJciF2zM1DDF6Q:AQqqjSlpWdlPgkQgoBERciFj1HF6Q

Malware Config

Targets

    • Target

      e89a03e73f12ec65040118c69b721c59_JaffaCakes118

    • Size

      193KB

    • MD5

      e89a03e73f12ec65040118c69b721c59

    • SHA1

      980308df2d39e456c817215abcc335c9cf9333a4

    • SHA256

      93e486554efa71e0da46388de32bc0be4c41948b18b4590990944bbc5344f868

    • SHA512

      daa81389d1f8be7f1dec2b345f3b2ff764bcc83ab817d72754f990253537fb7437d463b0be39d5b5fc15134a510a651df7bc8b23df13c1af45c79df40d800b1b

    • SSDEEP

      3072:ALk395hYXJkjSUxWpWdlP926IYWls7QddsouZnpyM8HERlJciF2zM1DDF6Q:AQqqjSlpWdlPgkQgoBERciFj1HF6Q

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Target

      201151922243.exe

    • Size

      25.1MB

    • MD5

      2f30d031eceaa35e41d78363747f9182

    • SHA1

      c5d467e10167330cdc5c4d859a81ffdd0c1ac101

    • SHA256

      52ab1dfca531c1b409af062478f1926d86fec266fe1c90a61c70676633cef8a5

    • SHA512

      b4729afc5910f8b37ef0b5a2591b52b13da5fd0d259ef8f5af1e798f71c9630d9b004dca8301b5d7a820d516d86ddc198ae52eb43a22edc1a73a1a830bd9c71d

    • SSDEEP

      3072:ALk395hYXJ708xqm3AdPSNtQ0SH54TiQgIwNxHv/YZzwCrddCnIsJBXc:AQqB00R3AdYbOUoIwNlnDCrddCxdc

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Target

      2011519222254.exe

    • Size

      308KB

    • MD5

      a8247344600b8cdf4f8debe3c8493ba8

    • SHA1

      bbc3ac5475dcdb16c4f38a180dbefb8dcefce4d0

    • SHA256

      639cbbed21a4c8cbf9d63ef3952fdc0078a816e4703b2c91557dce082d7d0063

    • SHA512

      cfa753ae805fd21db0fd1fea23f65b59173c589c77ea5fd73a9471647751c82d3d6d3d08f2a92a056a3e13f13fc93e8e9eb88fb5dd79d008232a27badfa994dd

    • SSDEEP

      6144:yiTtiWB0wL7t9J5Gp34EnBC4G7v4G7AWF5:5XB0wd9rGN7BEJAi

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks