Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5

  • Size

    5.5MB

  • Sample

    250207-gd9b4s1ke1

  • MD5

    b39c74780c2d2bbf7974fc1f138ba2c5

  • SHA1

    ade02c6dcd09289a9e9ffb4425f74bd687ea2aef

  • SHA256

    6a5b4981a7cd40b05bb466188315201082910b32134ccdf23012747264bb6603

  • SHA512

    6db667ab5c2e6c5edfb2e3460667ccf37341f956f514f4d43eee414b893623d1147a6fb1f56a22055af8398d3b36c91d4e456621d46c8421dae9e087717a8f44

  • SSDEEP

    49152:edq+YWfznMv72HP7moIKmfa1tYRGvM7gO70C:WPYWfe2HDiKmfaXYRB7j7F

Malware Config

Targets

    • Target

      JaffaCakes118_b39c74780c2d2bbf7974fc1f138ba2c5

    • Size

      5.5MB

    • MD5

      b39c74780c2d2bbf7974fc1f138ba2c5

    • SHA1

      ade02c6dcd09289a9e9ffb4425f74bd687ea2aef

    • SHA256

      6a5b4981a7cd40b05bb466188315201082910b32134ccdf23012747264bb6603

    • SHA512

      6db667ab5c2e6c5edfb2e3460667ccf37341f956f514f4d43eee414b893623d1147a6fb1f56a22055af8398d3b36c91d4e456621d46c8421dae9e087717a8f44

    • SSDEEP

      49152:edq+YWfznMv72HP7moIKmfa1tYRGvM7gO70C:WPYWfe2HDiKmfaXYRB7j7F

    • Blackshades

      Blackshades is a remote access trojan with various capabilities.

    • Blackshades family

    • Blackshades payload

    • Modifies firewall policy service

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks