Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
6a00f96910b958ad9e5c3394a2b31999_JaffaCakes118
-
Size
724KB
-
Sample
240523-gz716sgb4s
-
MD5
6a00f96910b958ad9e5c3394a2b31999
-
SHA1
927abdb2d7510b924da27ed47e00ab916ed3bd22
-
SHA256
ad9ea09ec4170fbca565125a45e530ca8f6105b4d5d48ec3a5c729af98932499
-
SHA512
9cf2531b5d7a7388449e0c91d00aeb48d505d5bc12693ba488644af1162782e31e6208338e8962641981db11912828d30a5d4694fcaaa66016c03ecb90a699cf
-
SSDEEP
12288:+SQycOwtOTKhshQ9tDxMW6yuZWLDAyiiTB/1uVSrDmA3zSKVHbQ63qm2p0Jl:tc6TKOhQ9tWyuZWfA0BUVSOA+KV7Q63z
Static task
static1
Behavioral task
behavioral1
Sample
6a00f96910b958ad9e5c3394a2b31999_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
6a00f96910b958ad9e5c3394a2b31999_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
6a00f96910b958ad9e5c3394a2b31999_JaffaCakes118
-
Size
724KB
-
MD5
6a00f96910b958ad9e5c3394a2b31999
-
SHA1
927abdb2d7510b924da27ed47e00ab916ed3bd22
-
SHA256
ad9ea09ec4170fbca565125a45e530ca8f6105b4d5d48ec3a5c729af98932499
-
SHA512
9cf2531b5d7a7388449e0c91d00aeb48d505d5bc12693ba488644af1162782e31e6208338e8962641981db11912828d30a5d4694fcaaa66016c03ecb90a699cf
-
SSDEEP
12288:+SQycOwtOTKhshQ9tDxMW6yuZWLDAyiiTB/1uVSrDmA3zSKVHbQ63qm2p0Jl:tc6TKOhQ9tWyuZWfA0BUVSOA+KV7Q63z
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-