Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
4270322408c1ccbc3f20511f12f9fefe_JaffaCakes118
-
Size
1.2MB
-
Sample
240514-wtlcjshd6z
-
MD5
4270322408c1ccbc3f20511f12f9fefe
-
SHA1
326a3640501c786d1293a162e3b80c9472353d19
-
SHA256
c9fa7ba9ae9c20373f723ae4cdfacb18053c42d38fa31dc1fb52cfffa2e9297a
-
SHA512
61b6b7885c325706f896d4e85ac18abdeeed9a3baa680057883e760992da3ced98e0a5c1f3dc382c8832687aa02030a2b1e1c8b48560178c498b5df678190e92
-
SSDEEP
24576:ltb20pkaCqT5TBWgNQ7arr9ekXqitTlpb6A:WVg5tQ7aVekbTj5
Static task
static1
Behavioral task
behavioral1
Sample
4270322408c1ccbc3f20511f12f9fefe_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
4270322408c1ccbc3f20511f12f9fefe_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
netwire
ihracat.myq-see.com:5770
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
2020-Clienst
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
hsFkbJUl
-
offline_keylogger
true
-
password
backdooR1
-
registry_autorun
false
-
use_mutex
true
Targets
-
-
Target
4270322408c1ccbc3f20511f12f9fefe_JaffaCakes118
-
Size
1.2MB
-
MD5
4270322408c1ccbc3f20511f12f9fefe
-
SHA1
326a3640501c786d1293a162e3b80c9472353d19
-
SHA256
c9fa7ba9ae9c20373f723ae4cdfacb18053c42d38fa31dc1fb52cfffa2e9297a
-
SHA512
61b6b7885c325706f896d4e85ac18abdeeed9a3baa680057883e760992da3ced98e0a5c1f3dc382c8832687aa02030a2b1e1c8b48560178c498b5df678190e92
-
SSDEEP
24576:ltb20pkaCqT5TBWgNQ7arr9ekXqitTlpb6A:WVg5tQ7aVekbTj5
-
NetWire RAT payload
-
Drops startup file
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-