Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    dd7565fbb173424cd438ea44a316b410_JaffaCakes118

  • Size

    112KB

  • Sample

    240913-clz17aybjm

  • MD5

    dd7565fbb173424cd438ea44a316b410

  • SHA1

    192aaee4cc47787bf7e63a1bdb9e448451e3a7f9

  • SHA256

    f0b67e6e8905396d6127aa7ad25f047e2537a7d15fc28207fd4186025411c0bd

  • SHA512

    dd7d41a705021515feaaa651b2c2d22168ef7b95be8c11dbb85027b26feb4d5b36eaa81e36e9d91e4c800205c73d4b5077da3fb0c9b9a43197ee1fbfd409794c

  • SSDEEP

    3072:KpkSyGG5YgJAZYNfmb4Ujb/BRxZhvpA0RTw3o0C:KpkSyGIYgJAwfk4ipxhR9w3i

Malware Config

Targets

    • Target

      dd7565fbb173424cd438ea44a316b410_JaffaCakes118

    • Size

      112KB

    • MD5

      dd7565fbb173424cd438ea44a316b410

    • SHA1

      192aaee4cc47787bf7e63a1bdb9e448451e3a7f9

    • SHA256

      f0b67e6e8905396d6127aa7ad25f047e2537a7d15fc28207fd4186025411c0bd

    • SHA512

      dd7d41a705021515feaaa651b2c2d22168ef7b95be8c11dbb85027b26feb4d5b36eaa81e36e9d91e4c800205c73d4b5077da3fb0c9b9a43197ee1fbfd409794c

    • SSDEEP

      3072:KpkSyGG5YgJAZYNfmb4Ujb/BRxZhvpA0RTw3o0C:KpkSyGIYgJAwfk4ipxhR9w3i

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks