Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
JaffaCakes118_325beb263217def7c4bd2bf3236e2f16
-
Size
1.5MB
-
Sample
250228-hw58vavnw8
-
MD5
325beb263217def7c4bd2bf3236e2f16
-
SHA1
c4f532eac3791f39952b3097a812b018237cad85
-
SHA256
4939e272199eac93aeb81e063c368dcd228b59cbe82522e893b1d47badaf421e
-
SHA512
a1a2347fe964c2884b4b9ddd560248550c12857e77f0d485aa0da900922d682770f6b505258f8a51d8cd2769b4bbf4f5eb2a225fbd9862ee08bffa1364972874
-
SSDEEP
24576:uHYxbvHwDr6Y/Hicgp/lUBuW6iefshRdrEAbm4z:u4xcD/6h0BuydYAm4z
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_325beb263217def7c4bd2bf3236e2f16.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_325beb263217def7c4bd2bf3236e2f16.exe
Resource
win10v2004-20250217-en
Malware Config
Targets
-
-
Target
JaffaCakes118_325beb263217def7c4bd2bf3236e2f16
-
Size
1.5MB
-
MD5
325beb263217def7c4bd2bf3236e2f16
-
SHA1
c4f532eac3791f39952b3097a812b018237cad85
-
SHA256
4939e272199eac93aeb81e063c368dcd228b59cbe82522e893b1d47badaf421e
-
SHA512
a1a2347fe964c2884b4b9ddd560248550c12857e77f0d485aa0da900922d682770f6b505258f8a51d8cd2769b4bbf4f5eb2a225fbd9862ee08bffa1364972874
-
SSDEEP
24576:uHYxbvHwDr6Y/Hicgp/lUBuW6iefshRdrEAbm4z:u4xcD/6h0BuydYAm4z
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload
-
Isrstealer family
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext
-