Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d9de733bca063f983b8a3c40a7b1841b_JaffaCakes118

  • Size

    896KB

  • Sample

    240911-h8rk8ayejr

  • MD5

    d9de733bca063f983b8a3c40a7b1841b

  • SHA1

    878364f338885f44aac1f8288808b8f902dfc141

  • SHA256

    b2709252523e31657d17b88090b7723de834366e36d25097db2f6c9326dcf80c

  • SHA512

    567bc89c33ec80c5c6871a4bca81a94fe2a978fc1debc14ae8efe1aef7083cc5abb91285ba4aece939613efd19fcc7c07fa3ba26c558f6f5390539ac9a8358cb

  • SSDEEP

    12288:FZlyqwEmkmauSVd2R3R0EcX0euXBzsEsU3z4ZuF:Hm6whk90BuyQ

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

174.100.27.229:80

209.126.6.222:8080

5.153.250.14:8080

192.241.146.84:8080

95.9.180.128:80

77.55.211.77:8080

85.105.140.135:443

45.33.77.42:8080

77.90.136.129:8080

94.176.234.118:443

190.163.31.26:80

190.6.193.152:8080

190.181.235.46:80

81.198.69.61:80

188.2.217.94:80

114.109.179.60:80

83.169.21.32:7080

137.74.106.111:7080

212.231.60.98:80

170.81.48.2:80

rsa_pubkey.plain

Targets

    • Target

      d9de733bca063f983b8a3c40a7b1841b_JaffaCakes118

    • Size

      896KB

    • MD5

      d9de733bca063f983b8a3c40a7b1841b

    • SHA1

      878364f338885f44aac1f8288808b8f902dfc141

    • SHA256

      b2709252523e31657d17b88090b7723de834366e36d25097db2f6c9326dcf80c

    • SHA512

      567bc89c33ec80c5c6871a4bca81a94fe2a978fc1debc14ae8efe1aef7083cc5abb91285ba4aece939613efd19fcc7c07fa3ba26c558f6f5390539ac9a8358cb

    • SSDEEP

      12288:FZlyqwEmkmauSVd2R3R0EcX0euXBzsEsU3z4ZuF:Hm6whk90BuyQ

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Emotet payload

      Detects Emotet payload in memory.

MITRE ATT&CK Enterprise v15

Tasks