Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

79fbaeb017...18.exe

windows7-x64

10

79fbaeb017...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79fbaeb0179ede82ef64517bb767cb22_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241028-rezjeaypaw

  • MD5

    79fbaeb0179ede82ef64517bb767cb22

  • SHA1

    4d7f8d7c5e7e068d12fd7825331fae47523a5669

  • SHA256

    9464744616b18af752a573ee701b6cb66b5f6a9b4283c0979eafb9eed700ea9e

  • SHA512

    32ec095bed57e0ae2f3b5a972894474ccf309f525420a19fba8cc5d80ffe0e855acf06909f9ff61423a930dc288c96fe9d6b4b3fd17e830a0bda621e8190a066

  • SSDEEP

    12288:F2n8iaYegKbzRUM7iXmuOL9t5CdPQIWdBtgM+unGyloYhe/7ey+KrSpZdFY1UaQt:FkdaeOJte0GNYheyy+KSpZdFY1Ud

Score
10/10
dcratdiscoveryinfostealerrat

Malware Config

Targets

    • Target

      79fbaeb0179ede82ef64517bb767cb22_JaffaCakes118

    • Size

      1.1MB

    • MD5

      79fbaeb0179ede82ef64517bb767cb22

    • SHA1

      4d7f8d7c5e7e068d12fd7825331fae47523a5669

    • SHA256

      9464744616b18af752a573ee701b6cb66b5f6a9b4283c0979eafb9eed700ea9e

    • SHA512

      32ec095bed57e0ae2f3b5a972894474ccf309f525420a19fba8cc5d80ffe0e855acf06909f9ff61423a930dc288c96fe9d6b4b3fd17e830a0bda621e8190a066

    • SSDEEP

      12288:F2n8iaYegKbzRUM7iXmuOL9t5CdPQIWdBtgM+unGyloYhe/7ey+KrSpZdFY1UaQt:FkdaeOJte0GNYheyy+KSpZdFY1Ud

    Score
    10/10
    dcratdiscoveryinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Dcrat family

      dcrat

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks