Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2d3144883fd8d46e3b8767dbbdccf001_JaffaCakes118

  • Size

    130KB

  • Sample

    240510-eedkqace53

  • MD5

    2d3144883fd8d46e3b8767dbbdccf001

  • SHA1

    d81d91e64cd02c40a8f6505a37f10432933c7084

  • SHA256

    ca7799ab2f4afb0c08ef11a9ff7e8a88f71e74798aaf31c5aac7f0fce6abf678

  • SHA512

    c459312b30680e43808f04fc3878ac75e0d06e270493e799f1df7d131b83051b3075764bcf4a4cfef1b0f6469a8caa57219c920d600557eaf03bcf1e94a1c275

  • SSDEEP

    3072:Mb3c3l+KQnWUXwbEA35HTdnU+ZBley/Z4XfIermq0ichYyeaK0FU:Mbs33OYRJzmq7/Z4XAermq0ichYyeaKD

Score
10/10

Malware Config

Extracted

Family

gafgyt

C2

127.0.0.1:7547

Targets

    • Target

      2d3144883fd8d46e3b8767dbbdccf001_JaffaCakes118

    • Size

      130KB

    • MD5

      2d3144883fd8d46e3b8767dbbdccf001

    • SHA1

      d81d91e64cd02c40a8f6505a37f10432933c7084

    • SHA256

      ca7799ab2f4afb0c08ef11a9ff7e8a88f71e74798aaf31c5aac7f0fce6abf678

    • SHA512

      c459312b30680e43808f04fc3878ac75e0d06e270493e799f1df7d131b83051b3075764bcf4a4cfef1b0f6469a8caa57219c920d600557eaf03bcf1e94a1c275

    • SSDEEP

      3072:Mb3c3l+KQnWUXwbEA35HTdnU+ZBley/Z4XfIermq0ichYyeaK0FU:Mbs33OYRJzmq7/Z4XAermq0ichYyeaKD

    Score
    9/10
    • Contacts a large (10341) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Reads system routing table

      Gets active network interfaces from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks