Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

OkEgjVmQ0r...yH.exe

windows7-x64

7

OkEgjVmQ0r...yH.exe

windows10-2004-x64

7

Osz8mRDYP0...iF.exe

windows7-x64

10

Osz8mRDYP0...iF.exe

windows10-2004-x64

10

rUtfalBbvX...Hx.exe

windows7-x64

9

rUtfalBbvX...Hx.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b931c903ff14d82dce6daf9934209b5c71f982359847ed3e342e25fa88c99f03

  • Size

    3.4MB

  • MD5

    194572ede01daaccc5f7a617b5c08468

  • SHA1

    b069072234d68d8ef01c49237c392735d45c4901

  • SHA256

    b931c903ff14d82dce6daf9934209b5c71f982359847ed3e342e25fa88c99f03

  • SHA512

    caa033d5a30e1c340455faebaf417d2bca2b0c95a24063df2bee78de8955d6d337f82bc16627583672e42f15022073ddbaaedc6f5a6984fdb65efb9f6a57bbae

  • SSDEEP

    98304:EY+TyVZ3iK1s61b7GmCTajwC+PuBCeRrsPQb:EYgyr3N+613Hma2PZWwm

Score
10/10
socelarsfabookie

Malware Config

Extracted

Family

socelars

C2

http://www.chosenncrowned.com/

Signatures

  • Detect Fabookie payload 1 IoCs
  • Fabookie family
    fabookie
  • Socelars family
    socelars
  • Socelars payload 1 IoCs
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_b931c903ff14d82dce6daf9934209b5c71f982359847ed3e342e25fa88c99f03
    .zip
  • OkEgjVmQ0rPYTjBDwBy70NyH.exe
    .exe windows:5 windows x86 arch:x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • Osz8mRDYP0laXozOTuxyUiiF.exe
    .exe windows:6 windows x86 arch:x86

    d69e4c13e25f0ad622344ac56118c0df


    Headers

    Imports

    Sections

  • rUtfalBbvXy6eEmMrseqpFHx.exe
    .exe windows:6 windows x64 arch:x64

    23e911f9a82ac0d345fa6cc9104b6bf4


    Headers

    Imports

    Sections