Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2718fad7bfaa7b3a37e11d8aeda97c6d_JaffaCakes118

  • Size

    156KB

  • Sample

    240508-2v2ntaed38

  • MD5

    2718fad7bfaa7b3a37e11d8aeda97c6d

  • SHA1

    25b68c19c752daff9b074a302cfa1da7d5b226da

  • SHA256

    38bcc665ea1f9f4c69e557fcb5148c5699bb97fbc6d0d6a8aa51291f57f8ca34

  • SHA512

    d774b780089d6eb23fa318e6b021538970de5187b81739ca89aa131fa1a3991bde610fd38656c67ddd705cf62bb64568850da9d7c7ffe4357912813772a6948c

  • SSDEEP

    1536:xXGNxEKJx6qdlaPLA1tjUb6vfEwDfJ8rWR0hoZjeZtaNT6hSegcAe6frjq8jI:tGnEKJx6q6zUqOr5Z4aNipDj6f/qn

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

47.146.32.175:80

212.51.142.238:8080

200.55.243.138:8080

114.146.222.200:80

153.126.210.205:7080

121.124.124.40:7080

222.214.218.37:4143

67.241.24.163:8080

180.92.239.110:8080

203.153.216.189:7080

119.198.40.179:80

70.167.215.250:8080

168.235.67.138:7080

190.55.181.54:443

139.59.60.244:8080

189.212.199.126:443

78.24.219.147:8080

61.19.246.238:443

137.59.187.107:8080

87.106.139.101:8080

rsa_pubkey.plain

Targets

    • Target

      2718fad7bfaa7b3a37e11d8aeda97c6d_JaffaCakes118

    • Size

      156KB

    • MD5

      2718fad7bfaa7b3a37e11d8aeda97c6d

    • SHA1

      25b68c19c752daff9b074a302cfa1da7d5b226da

    • SHA256

      38bcc665ea1f9f4c69e557fcb5148c5699bb97fbc6d0d6a8aa51291f57f8ca34

    • SHA512

      d774b780089d6eb23fa318e6b021538970de5187b81739ca89aa131fa1a3991bde610fd38656c67ddd705cf62bb64568850da9d7c7ffe4357912813772a6948c

    • SSDEEP

      1536:xXGNxEKJx6qdlaPLA1tjUb6vfEwDfJ8rWR0hoZjeZtaNT6hSegcAe6frjq8jI:tGnEKJx6q6zUqOr5Z4aNipDj6f/qn

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Matrix

Tasks