Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    1f4f8c28e684d5db5ce22f7742826700_JaffaCakes118

  • Size

    248KB

  • Sample

    240702-pjyfsswdmm

  • MD5

    1f4f8c28e684d5db5ce22f7742826700

  • SHA1

    282a9257541437dbc586d4f953f4092f96dccaaa

  • SHA256

    3fde380555135b231bdff61f8ff4a28169e4df0c6b9eab4378cbf50160f3a235

  • SHA512

    5fc8d07c066114dbf1af31e0774c3c8a8a8c39c44be9b12bf28282f1daa7aa02fa335397620c3a27c3a49751983497ae656712f01be393871b359d5404949af9

  • SSDEEP

    6144:SSaBi2ZFUOnhD8mc3oOpvXZ26u/6mv5gdC:SXRZHnhvfOpvXUx/6cgdC

Malware Config

Extracted

Family

dridex

Botnet

111

C2

77.220.64.149:443

80.11.32.115:4646

77.81.247.140:5037

rc4.plain
1
39PQcfueoisEPCXAoGExy539GlN6nK2LElowAgy4
rc4.plain
1
yO2qyzDNJFpQ4BDRET5KTlKr0gm7ie684isgcwGHHqjjRmXliM4I9XyTK9JqHANcqj

Targets

    • Target

      1f4f8c28e684d5db5ce22f7742826700_JaffaCakes118

    • Size

      248KB

    • MD5

      1f4f8c28e684d5db5ce22f7742826700

    • SHA1

      282a9257541437dbc586d4f953f4092f96dccaaa

    • SHA256

      3fde380555135b231bdff61f8ff4a28169e4df0c6b9eab4378cbf50160f3a235

    • SHA512

      5fc8d07c066114dbf1af31e0774c3c8a8a8c39c44be9b12bf28282f1daa7aa02fa335397620c3a27c3a49751983497ae656712f01be393871b359d5404949af9

    • SSDEEP

      6144:SSaBi2ZFUOnhD8mc3oOpvXZ26u/6mv5gdC:SXRZHnhvfOpvXUx/6cgdC

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.