Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

JaffaCakes...31.exe

windows7-x64

10

JaffaCakes...31.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6228e0bddca6629b077ea340bd142f31

  • Size

    95KB

  • Sample

    250311-an35hstzes

  • MD5

    6228e0bddca6629b077ea340bd142f31

  • SHA1

    2c03ff3ed68866a2829e1fa46570e0955a385225

  • SHA256

    38d9dfa2cbab55f4d4f182dd68a85c941e26d6484fd3d1952c7ad81c37f53928

  • SHA512

    3180a05f1ad6129fe1276a904795d08b759f9bf097af45a6a122f3c027e99ccfa9d1303365a84fd1cab9f71bc62f3969e0a06a972c30358f14d086513aa433e9

  • SSDEEP

    1536:fHFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prnMW5mb5EOc:fxS4jHS8q/3nTzePCwNUh4E9nWbGOc

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_6228e0bddca6629b077ea340bd142f31

    • Size

      95KB

    • MD5

      6228e0bddca6629b077ea340bd142f31

    • SHA1

      2c03ff3ed68866a2829e1fa46570e0955a385225

    • SHA256

      38d9dfa2cbab55f4d4f182dd68a85c941e26d6484fd3d1952c7ad81c37f53928

    • SHA512

      3180a05f1ad6129fe1276a904795d08b759f9bf097af45a6a122f3c027e99ccfa9d1303365a84fd1cab9f71bc62f3969e0a06a972c30358f14d086513aa433e9

    • SSDEEP

      1536:fHFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prnMW5mb5EOc:fxS4jHS8q/3nTzePCwNUh4E9nWbGOc

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks