Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d4d6e57106f5ddd7f32e64139d594ceb_JaffaCakes118

  • Size

    77KB

  • Sample

    240908-vgpc1azbpe

  • MD5

    d4d6e57106f5ddd7f32e64139d594ceb

  • SHA1

    5ca9bb68ff36ab75d433dde47598e56575d4bfd7

  • SHA256

    a2a831dd44c73b337ea41e76d33c2f3a39349795af74f5d02e510541aab7b8db

  • SHA512

    44dfc4a3631476a2e86a7c836c6f766203d5425f963c8ac2434e64889b16add7f36b29fff8719da131df5590b1ce840abc41bc735d376dedee2aad9a11eab339

  • SSDEEP

    1536:G4Z8LUay6+vl/R1KI5ysUKR9EiYHXwpnZ9q6LjhjTETO:B6ry6+vdGI5ysUuTZ9q8jZTIO

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Targets

    • Target

      d4d6e57106f5ddd7f32e64139d594ceb_JaffaCakes118

    • Size

      77KB

    • MD5

      d4d6e57106f5ddd7f32e64139d594ceb

    • SHA1

      5ca9bb68ff36ab75d433dde47598e56575d4bfd7

    • SHA256

      a2a831dd44c73b337ea41e76d33c2f3a39349795af74f5d02e510541aab7b8db

    • SHA512

      44dfc4a3631476a2e86a7c836c6f766203d5425f963c8ac2434e64889b16add7f36b29fff8719da131df5590b1ce840abc41bc735d376dedee2aad9a11eab339

    • SSDEEP

      1536:G4Z8LUay6+vl/R1KI5ysUKR9EiYHXwpnZ9q6LjhjTETO:B6ry6+vdGI5ysUuTZ9q8jZTIO

    • Contacts a large (163767) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Enumerates active TCP sockets

      Gets active TCP sockets from /proc virtual filesystem.

MITRE ATT&CK Enterprise v15

Tasks