Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...2f.exe

windows7-x64

10

JaffaCakes...2f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_389def358262aee04d1a7fc5cbe1572f

  • Size

    58KB

  • Sample

    250301-m4fqdazms4

  • MD5

    389def358262aee04d1a7fc5cbe1572f

  • SHA1

    001435cc319e22d60c457f896461012dea714491

  • SHA256

    38f3e8f3eaa146b7d24fc35b01a8b711cec828205879cf5baad4fd548bde0a73

  • SHA512

    2887f7cc0eb0da2dcd0513a918bab27e3267d376f956282ff9aff8d1277202865296af630fe9cc376b3df2ac8323510c2411897752f1be931444533e020dbd69

  • SSDEEP

    1536:N7yxiWeexIhxb+g86PKwQJvIzp9fuPfXdCeC:NyxiWeeehp+NwQBIttuHsH

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_389def358262aee04d1a7fc5cbe1572f

    • Size

      58KB

    • MD5

      389def358262aee04d1a7fc5cbe1572f

    • SHA1

      001435cc319e22d60c457f896461012dea714491

    • SHA256

      38f3e8f3eaa146b7d24fc35b01a8b711cec828205879cf5baad4fd548bde0a73

    • SHA512

      2887f7cc0eb0da2dcd0513a918bab27e3267d376f956282ff9aff8d1277202865296af630fe9cc376b3df2ac8323510c2411897752f1be931444533e020dbd69

    • SSDEEP

      1536:N7yxiWeexIhxb+g86PKwQJvIzp9fuPfXdCeC:NyxiWeeehp+NwQBIttuHsH

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks