Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
2d3144883fd8d46e3b8767dbbdccf001_JaffaCakes118
-
Size
130KB
-
Sample
240510-eedkqace53
-
MD5
2d3144883fd8d46e3b8767dbbdccf001
-
SHA1
d81d91e64cd02c40a8f6505a37f10432933c7084
-
SHA256
ca7799ab2f4afb0c08ef11a9ff7e8a88f71e74798aaf31c5aac7f0fce6abf678
-
SHA512
c459312b30680e43808f04fc3878ac75e0d06e270493e799f1df7d131b83051b3075764bcf4a4cfef1b0f6469a8caa57219c920d600557eaf03bcf1e94a1c275
-
SSDEEP
3072:Mb3c3l+KQnWUXwbEA35HTdnU+ZBley/Z4XfIermq0ichYyeaK0FU:Mbs33OYRJzmq7/Z4XAermq0ichYyeaKD
Behavioral task
behavioral1
Sample
2d3144883fd8d46e3b8767dbbdccf001_JaffaCakes118
Resource
ubuntu1804-amd64-20240508-en
Malware Config
Extracted
gafgyt
127.0.0.1:7547
Targets
-
-
Target
2d3144883fd8d46e3b8767dbbdccf001_JaffaCakes118
-
Size
130KB
-
MD5
2d3144883fd8d46e3b8767dbbdccf001
-
SHA1
d81d91e64cd02c40a8f6505a37f10432933c7084
-
SHA256
ca7799ab2f4afb0c08ef11a9ff7e8a88f71e74798aaf31c5aac7f0fce6abf678
-
SHA512
c459312b30680e43808f04fc3878ac75e0d06e270493e799f1df7d131b83051b3075764bcf4a4cfef1b0f6469a8caa57219c920d600557eaf03bcf1e94a1c275
-
SSDEEP
3072:Mb3c3l+KQnWUXwbEA35HTdnU+ZBley/Z4XfIermq0ichYyeaK0FU:Mbs33OYRJzmq7/Z4XAermq0ichYyeaKD
Score9/10-
Contacts a large (10341) amount of remote hosts
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
-
Creates a large amount of network flows
This may indicate a network scan to discover remotely running services.
-
Enumerates active TCP sockets
Gets active TCP sockets from /proc virtual filesystem.
-
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system routing table
Gets active network interfaces from /proc virtual filesystem.
-