Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
fc00a5a4d3e9cf0798234a1cf1315804_JaffaCakes118
-
Size
170KB
-
Sample
240928-lgqrds1cld
-
MD5
fc00a5a4d3e9cf0798234a1cf1315804
-
SHA1
1b0d61fbbafebe9e66bd698f30441da2be4b58a6
-
SHA256
6f0dde5e11aaba6a6dad481c20b67d0bbe3986db90c74104aba0fd45f7818c6c
-
SHA512
0d7640f4e2bb4512e9eea795228d5afb7e5d9fe96a259aab7fb7fa480f9a775ed721b09a281d2c6ffb044463657fc9f07fb6ba3cf5113ba3f24e05e5f4b2f777
-
SSDEEP
3072:vuVB9J7pd7rv0xsuilTYqEtZj3PEk5sdUC+0oKfYel:GPz1dH0qpdSnj/EusdUC3oKP
Static task
static1
Behavioral task
behavioral1
Sample
fc00a5a4d3e9cf0798234a1cf1315804_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc00a5a4d3e9cf0798234a1cf1315804_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
pony
http://178.77.99.145:8080/pony/gate.php
http://49.156.20.209:8080/pony/gate.php
-
payload_url
http://66.216.91.242/2YtKjEo.exe
http://misterm.at/Cttr.exe
Targets
-
-
Target
fc00a5a4d3e9cf0798234a1cf1315804_JaffaCakes118
-
Size
170KB
-
MD5
fc00a5a4d3e9cf0798234a1cf1315804
-
SHA1
1b0d61fbbafebe9e66bd698f30441da2be4b58a6
-
SHA256
6f0dde5e11aaba6a6dad481c20b67d0bbe3986db90c74104aba0fd45f7818c6c
-
SHA512
0d7640f4e2bb4512e9eea795228d5afb7e5d9fe96a259aab7fb7fa480f9a775ed721b09a281d2c6ffb044463657fc9f07fb6ba3cf5113ba3f24e05e5f4b2f777
-
SSDEEP
3072:vuVB9J7pd7rv0xsuilTYqEtZj3PEk5sdUC+0oKfYel:GPz1dH0qpdSnj/EusdUC3oKP
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-