Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b9d0201d96bf236e37d58605857b6879_JaffaCakes118
-
Size
555KB
-
Sample
241202-x76q3synev
-
MD5
b9d0201d96bf236e37d58605857b6879
-
SHA1
3733174095b7b94f73d2f866f03503ed19477ad9
-
SHA256
a916a084fce6071fb264808dccdf11e97ab1eb67b804634e2d98411aef86dcad
-
SHA512
6f3f3f47ab022f108d9939fedf1fa36386ec6e8426ebd370390c9a8918b5d8b1de0b97e6b388f0b78dfff2640ebce5d7b5991222f8a91c7ef733a7bd2b53d092
-
SSDEEP
12288:3DWzZctGgmU79XFj/Zr1oF9UhkSYOpxHB7ZkyfRmQKys1RIY:aWUgmIRBx7xHB7ZRf2ysIY
Static task
static1
Behavioral task
behavioral1
Sample
b9d0201d96bf236e37d58605857b6879_JaffaCakes118.exe
Resource
win7-20240903-en
Malware Config
Extracted
cryptbot
haipuo52.top
morbaq05.top
-
payload_url
http://zelveu07.top/download.php?file=lv.exe
Targets
-
-
Target
b9d0201d96bf236e37d58605857b6879_JaffaCakes118
-
Size
555KB
-
MD5
b9d0201d96bf236e37d58605857b6879
-
SHA1
3733174095b7b94f73d2f866f03503ed19477ad9
-
SHA256
a916a084fce6071fb264808dccdf11e97ab1eb67b804634e2d98411aef86dcad
-
SHA512
6f3f3f47ab022f108d9939fedf1fa36386ec6e8426ebd370390c9a8918b5d8b1de0b97e6b388f0b78dfff2640ebce5d7b5991222f8a91c7ef733a7bd2b53d092
-
SSDEEP
12288:3DWzZctGgmU79XFj/Zr1oF9UhkSYOpxHB7ZkyfRmQKys1RIY:aWUgmIRBx7xHB7ZRf2ysIY
-
CryptBot payload
-
Cryptbot family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-