Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

464fffc4a1...18.exe

windows7-x64

10

464fffc4a1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    464fffc4a1648fb7202fbe6c141bad13_JaffaCakes118

  • Size

    332KB

  • Sample

    240714-sa1fksxejb

  • MD5

    464fffc4a1648fb7202fbe6c141bad13

  • SHA1

    f409529fb7163ba5ffa9f8df2e15965619d7a9e3

  • SHA256

    8f94b4bfd2e47dbccf2c7b522c7cfcf993ef01219835725d99eaed1943601c6e

  • SHA512

    0631080b6b50eb63350680b203ff777c67a051ccd2510a9b2440041e237a6d397abe4a885ef36eed2b0cdb8507898ebddac32745117673be930751babccfa096

  • SSDEEP

    1536:rUwPGSmhCmW7yCHyJgPlH/oJjhlvsSPCwhcuEJ9GuG+SnZQAPswV0:rHGSk7CybJtlptit9I+SnZ1Ewe

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Extracted

Family

xtremerat

C2

maom.no-ip.org

Targets

    • Target

      464fffc4a1648fb7202fbe6c141bad13_JaffaCakes118

    • Size

      332KB

    • MD5

      464fffc4a1648fb7202fbe6c141bad13

    • SHA1

      f409529fb7163ba5ffa9f8df2e15965619d7a9e3

    • SHA256

      8f94b4bfd2e47dbccf2c7b522c7cfcf993ef01219835725d99eaed1943601c6e

    • SHA512

      0631080b6b50eb63350680b203ff777c67a051ccd2510a9b2440041e237a6d397abe4a885ef36eed2b0cdb8507898ebddac32745117673be930751babccfa096

    • SSDEEP

      1536:rUwPGSmhCmW7yCHyJgPlH/oJjhlvsSPCwhcuEJ9GuG+SnZQAPswV0:rHGSk7CybJtlptit9I+SnZ1Ewe

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks