Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b95fcc03eacfc9fff233ab32c4ed2378_JaffaCakes118
-
Size
19KB
-
Sample
240822-2r2jms1hqf
-
MD5
b95fcc03eacfc9fff233ab32c4ed2378
-
SHA1
908267d02da0ce1a4af3d1e1654e5a5d6f53700f
-
SHA256
23500ae03d6536662e94394a31bcdd5c7d34f5f8a207e0dc885fd473c958e018
-
SHA512
33e7146f8056a8b5fa6848f19adea568be75eb1491da5ca8d333c16ea7176a6c1a1365cc7c0a2426705451c11e7ed7d4a5a85de885c930588ac2c316ee2c28bc
-
SSDEEP
384:gHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSIldo0ykUNu7R:NZfuHUvwDKP6kMpLdiR+
Malware Config
Targets
-
-
Target
b95fcc03eacfc9fff233ab32c4ed2378_JaffaCakes118
-
Size
19KB
-
MD5
b95fcc03eacfc9fff233ab32c4ed2378
-
SHA1
908267d02da0ce1a4af3d1e1654e5a5d6f53700f
-
SHA256
23500ae03d6536662e94394a31bcdd5c7d34f5f8a207e0dc885fd473c958e018
-
SHA512
33e7146f8056a8b5fa6848f19adea568be75eb1491da5ca8d333c16ea7176a6c1a1365cc7c0a2426705451c11e7ed7d4a5a85de885c930588ac2c316ee2c28bc
-
SSDEEP
384:gHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSIldo0ykUNu7R:NZfuHUvwDKP6kMpLdiR+
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1