Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    35ddf6436f8b57f36f926c5cf200e2c9_JaffaCakes118

  • Size

    607KB

  • Sample

    240710-w2hlmasgqj

  • MD5

    35ddf6436f8b57f36f926c5cf200e2c9

  • SHA1

    934310447cec525603f306008b168ff227fc9072

  • SHA256

    2781561cbaec7ac6b6f3c9e17b1f2dbb5ab96ae0d8a0d560c0c09e56bd0f1c19

  • SHA512

    7c86cab7dccfa5678c444f7cc8d30243910dc94888559b1ce7e6e9533b79675500ba9e2bb03ea7253583411dee2b73bc96fee02e02a038d7f4fc4976ad257db0

  • SSDEEP

    12288:dsz0aWhlk4x0t4B4ReoMgjJ2HI0K/lGRgOUqmq9kR6lhKX1ae/flS/rio:da0aKjdgjavK/cRgOnmq9g6M5/NS

Malware Config

Extracted

Family

xtremerat

C2

cescmouad.zapto.org

Targets

    • Target

      35ddf6436f8b57f36f926c5cf200e2c9_JaffaCakes118

    • Size

      607KB

    • MD5

      35ddf6436f8b57f36f926c5cf200e2c9

    • SHA1

      934310447cec525603f306008b168ff227fc9072

    • SHA256

      2781561cbaec7ac6b6f3c9e17b1f2dbb5ab96ae0d8a0d560c0c09e56bd0f1c19

    • SHA512

      7c86cab7dccfa5678c444f7cc8d30243910dc94888559b1ce7e6e9533b79675500ba9e2bb03ea7253583411dee2b73bc96fee02e02a038d7f4fc4976ad257db0

    • SSDEEP

      12288:dsz0aWhlk4x0t4B4ReoMgjJ2HI0K/lGRgOUqmq9kR6lhKX1ae/flS/rio:da0aKjdgjavK/cRgOnmq9g6M5/NS

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks