Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

d4e1c7ddfb...18.exe

windows7-x64

10

d4e1c7ddfb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d4e1c7ddfb06cc9dc9b499502a988ffc_JaffaCakes118

  • Size

    172KB

  • Sample

    240908-vx8ftazhmc

  • MD5

    d4e1c7ddfb06cc9dc9b499502a988ffc

  • SHA1

    9f5f6bfb7c925eb44d03b7a29b8b9ed39f7edffb

  • SHA256

    1f5b5f662b6740934ae20a5bd735686d49bdc15aec27165ef74275b063375477

  • SHA512

    3a0491c412e62534950bb5063e14dc0a99c9b985b52571309aa774d2c33f80bbfcc30a345d78a2fcf14a1941c9b9faa10b66f0ac8a00dd0906b69c8f3e713c7b

  • SSDEEP

    3072:25eRAMziHGYsyikqOajWgBrRYfnE4sl5BUjJj1MXqN3c5Zy9BaoGJ1uG4at:25emMSBs5OtgBefnEJqjJiXo3OZ+Guat

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Extracted

Family

xtremerat

C2

kyfen.no-ip.biz

�䌀ကunnamed.no-ip.biz

Targets

    • Target

      d4e1c7ddfb06cc9dc9b499502a988ffc_JaffaCakes118

    • Size

      172KB

    • MD5

      d4e1c7ddfb06cc9dc9b499502a988ffc

    • SHA1

      9f5f6bfb7c925eb44d03b7a29b8b9ed39f7edffb

    • SHA256

      1f5b5f662b6740934ae20a5bd735686d49bdc15aec27165ef74275b063375477

    • SHA512

      3a0491c412e62534950bb5063e14dc0a99c9b985b52571309aa774d2c33f80bbfcc30a345d78a2fcf14a1941c9b9faa10b66f0ac8a00dd0906b69c8f3e713c7b

    • SSDEEP

      3072:25eRAMziHGYsyikqOajWgBrRYfnE4sl5BUjJj1MXqN3c5Zy9BaoGJ1uG4at:25emMSBs5OtgBefnEJqjJiXo3OZ+Guat

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks