Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
edc7fab4454ca88d834094ad33a52ad0_JaffaCakes118
-
Size
259KB
-
Sample
240411-s7s3rsef98
-
MD5
edc7fab4454ca88d834094ad33a52ad0
-
SHA1
b13df4f78421ac2bc235f4dd88720ed3fe0c689a
-
SHA256
13cb0fdc377ec006b3b0e181e93112774cfc054de9305a57637d4b1ec0f50f4d
-
SHA512
3f3758371a192091e30afe050786d27772590fb60f180eeb1d154539f3100a7ee838c4618f52f0f1e108241af348e1593ae3bb4678ff9960c5d79bae2a7896ac
-
SSDEEP
6144:1/HyObKhe0jjCCsyRifFlP04YyJpy2Kp1Dyy4VafQSWHGjOgi5/iF6a6X:1Che0jrQTM4Y8y2ONyy4ofNOgi5naU
Static task
static1
Behavioral task
behavioral1
Sample
edc7fab4454ca88d834094ad33a52ad0_JaffaCakes118.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
edc7fab4454ca88d834094ad33a52ad0_JaffaCakes118.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
In^Df(#7
Targets
-
-
Target
edc7fab4454ca88d834094ad33a52ad0_JaffaCakes118
-
Size
259KB
-
MD5
edc7fab4454ca88d834094ad33a52ad0
-
SHA1
b13df4f78421ac2bc235f4dd88720ed3fe0c689a
-
SHA256
13cb0fdc377ec006b3b0e181e93112774cfc054de9305a57637d4b1ec0f50f4d
-
SHA512
3f3758371a192091e30afe050786d27772590fb60f180eeb1d154539f3100a7ee838c4618f52f0f1e108241af348e1593ae3bb4678ff9960c5d79bae2a7896ac
-
SSDEEP
6144:1/HyObKhe0jjCCsyRifFlP04YyJpy2Kp1Dyy4VafQSWHGjOgi5/iF6a6X:1Che0jrQTM4Y8y2ONyy4ofNOgi5naU
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-