Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
ebed485b42c0524c09fc9a6b63ed6d17_JaffaCakes118
-
Size
121KB
-
Sample
240919-wx25gasgnb
-
MD5
ebed485b42c0524c09fc9a6b63ed6d17
-
SHA1
ae7ab009bdf62acd8cbe4661839c45bae847436a
-
SHA256
cadf58a40041cdbdac68b02e259d45310985ae8b236ce04211da5316d108094d
-
SHA512
715900554fa4e73fe66bbd09bb2955072da57ba50a789caff27d2fb502fef7709297a5065687941e02c6cfb6efce78a9bc4fc07ef5c1baff62dd3aa2b7463296
-
SSDEEP
3072:kQSkOYWUb7pYrlBnqn387MW3ytmk5KMUOK/Ye7:3SkOra1YRBq3QRCEu4OKd
Static task
static1
Behavioral task
behavioral1
Sample
ebed485b42c0524c09fc9a6b63ed6d17_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ebed485b42c0524c09fc9a6b63ed6d17_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
pony
http://178.77.99.145:8080/pony/gate.php
http://49.156.20.209:8080/pony/gate.php
-
payload_url
http://ftp.mebel4u.home.pl/9kEg3oB.exe
http://www.lovetaoyuan.com/v7a47NA.exe
Targets
-
-
Target
ebed485b42c0524c09fc9a6b63ed6d17_JaffaCakes118
-
Size
121KB
-
MD5
ebed485b42c0524c09fc9a6b63ed6d17
-
SHA1
ae7ab009bdf62acd8cbe4661839c45bae847436a
-
SHA256
cadf58a40041cdbdac68b02e259d45310985ae8b236ce04211da5316d108094d
-
SHA512
715900554fa4e73fe66bbd09bb2955072da57ba50a789caff27d2fb502fef7709297a5065687941e02c6cfb6efce78a9bc4fc07ef5c1baff62dd3aa2b7463296
-
SSDEEP
3072:kQSkOYWUb7pYrlBnqn387MW3ytmk5KMUOK/Ye7:3SkOra1YRBq3QRCEu4OKd
-
Credentials from Password Stores: Credentials from Web Browsers
Malicious Access or copy of Web Browser Credential store.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-