Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
f270c62d26b0fb5e22fedcefde6bc415_JaffaCakes118
-
Size
108KB
-
Sample
241215-ftl13swqhj
-
MD5
f270c62d26b0fb5e22fedcefde6bc415
-
SHA1
95c1d077d6e7898876242929d520af63f668834e
-
SHA256
f5a4fe49a050d203aa082f124c28656c630f9412a7cfcbffd0481ae611aab0fe
-
SHA512
06da0c88631a74cec8cc992f6bdaa02a265eef748b0743a66afcf11e61dbb1bb00f2b64ff116e3fbcb7f45037a59a5d56cdda499d7bb560d3deccb1c3b36e30e
-
SSDEEP
1536:/fb0BwlEnkco5YG9pMvqc/qxh1zcQe5VEExUVS3i8Yzv90PB8Qd:wBFG9CyfCQ03ji8YL909d
Malware Config
Targets
-
-
Target
f270c62d26b0fb5e22fedcefde6bc415_JaffaCakes118
-
Size
108KB
-
MD5
f270c62d26b0fb5e22fedcefde6bc415
-
SHA1
95c1d077d6e7898876242929d520af63f668834e
-
SHA256
f5a4fe49a050d203aa082f124c28656c630f9412a7cfcbffd0481ae611aab0fe
-
SHA512
06da0c88631a74cec8cc992f6bdaa02a265eef748b0743a66afcf11e61dbb1bb00f2b64ff116e3fbcb7f45037a59a5d56cdda499d7bb560d3deccb1c3b36e30e
-
SSDEEP
1536:/fb0BwlEnkco5YG9pMvqc/qxh1zcQe5VEExUVS3i8Yzv90PB8Qd:wBFG9CyfCQ03ji8YL909d
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1