Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    bef563d6f91fc4cb7f038ead74d86309_JaffaCakes118

  • Size

    426KB

  • Sample

    240824-tjrepsxhqg

  • MD5

    bef563d6f91fc4cb7f038ead74d86309

  • SHA1

    111426bc504fde5a376f2acec1a02f8d21e1c323

  • SHA256

    ccc1009362f2cac4dd44285190ce28df252ef95bf4dcc2e094ae18d5929427c4

  • SHA512

    3e7cde075e23b236f9b2778b6b1a303643f70bffa0e6b778df9ed42a663caa1ad0d4e429495dc5c5ed07fccd6e674a503eb4b4dfcb479fda9ba4a067c61dc050

  • SSDEEP

    6144:qexrS9j0YKTs4KOxXF2idZecnl20lHRxp3gYRpqY/E1CU8fBIlHh+F9WuvEhK:xxrE0lnF3Z4mxxpRprMoU8fWlhapX

Malware Config

Targets

    • Target

      bef563d6f91fc4cb7f038ead74d86309_JaffaCakes118

    • Size

      426KB

    • MD5

      bef563d6f91fc4cb7f038ead74d86309

    • SHA1

      111426bc504fde5a376f2acec1a02f8d21e1c323

    • SHA256

      ccc1009362f2cac4dd44285190ce28df252ef95bf4dcc2e094ae18d5929427c4

    • SHA512

      3e7cde075e23b236f9b2778b6b1a303643f70bffa0e6b778df9ed42a663caa1ad0d4e429495dc5c5ed07fccd6e674a503eb4b4dfcb479fda9ba4a067c61dc050

    • SSDEEP

      6144:qexrS9j0YKTs4KOxXF2idZecnl20lHRxp3gYRpqY/E1CU8fBIlHh+F9WuvEhK:xxrE0lnF3Z4mxxpRprMoU8fWlhapX

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks