Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2608c252c9e67d488617e88a19c360d6_JaffaCakes118
-
Size
161KB
-
Sample
240508-wjgllsgb2z
-
MD5
2608c252c9e67d488617e88a19c360d6
-
SHA1
8e9f5503e57bf54daac28af0ddacdd0fff078b48
-
SHA256
2bcff2d60c9a399db693acfb225d67f47cfd2353510f8bf5b32557e280363abe
-
SHA512
e7e848380a582bf219f7b2aa376eedfe46dc285087633117b7fd473926fa5bd6d4a117da733d7ab80518a3ad65605facb78010f7864036702ab826f111cfbc1b
-
SSDEEP
3072:ejTLZhs0uDI0rAfOXl+y+uql/GOtsrVrqhTqndtndhndKndI:4TLFuD6fOXlql/GLJrqqndtndhndKndI
Behavioral task
behavioral1
Sample
2608c252c9e67d488617e88a19c360d6_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Extracted
pony
http://butterchoco.net/admin/bull/gate.php
Targets
-
-
Target
2608c252c9e67d488617e88a19c360d6_JaffaCakes118
-
Size
161KB
-
MD5
2608c252c9e67d488617e88a19c360d6
-
SHA1
8e9f5503e57bf54daac28af0ddacdd0fff078b48
-
SHA256
2bcff2d60c9a399db693acfb225d67f47cfd2353510f8bf5b32557e280363abe
-
SHA512
e7e848380a582bf219f7b2aa376eedfe46dc285087633117b7fd473926fa5bd6d4a117da733d7ab80518a3ad65605facb78010f7864036702ab826f111cfbc1b
-
SSDEEP
3072:ejTLZhs0uDI0rAfOXl+y+uql/GOtsrVrqhTqndtndhndKndI:4TLFuD6fOXlql/GLJrqqndtndhndKndI
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Accesses Microsoft Outlook accounts
-
Accesses Microsoft Outlook profiles
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-