Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

JaffaCakes...16.exe

windows7-x64

10

JaffaCakes...16.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6267aab275099ccbfe04578dbb6c2216

  • Size

    288KB

  • Sample

    250311-bq97aavqy6

  • MD5

    6267aab275099ccbfe04578dbb6c2216

  • SHA1

    ddb8f69209f48e23e155348ba6d88ebcfc51d373

  • SHA256

    1e535931be296e3bd5cdf4b498756173f7bb68a95b6ee3825f93113c96d69afc

  • SHA512

    3b02696eeb7c6fc04354398e41cea20adfadf775b7ad8509be34f04ae635a506f735eb5b75afb59739ec0f382f2f6f9205f8b24278239b8cb84457387bbb0599

  • SSDEEP

    6144:QGzRxSVtp0l6whGfsKR+zkBpTaa5tJHXhHANUTNd:jt0VPFfsKAkrbPlXhHANUTNd

Score
10/10
gh0stratdiscoverypersistenceratupx

Malware Config

Targets

    • Target

      JaffaCakes118_6267aab275099ccbfe04578dbb6c2216

    • Size

      288KB

    • MD5

      6267aab275099ccbfe04578dbb6c2216

    • SHA1

      ddb8f69209f48e23e155348ba6d88ebcfc51d373

    • SHA256

      1e535931be296e3bd5cdf4b498756173f7bb68a95b6ee3825f93113c96d69afc

    • SHA512

      3b02696eeb7c6fc04354398e41cea20adfadf775b7ad8509be34f04ae635a506f735eb5b75afb59739ec0f382f2f6f9205f8b24278239b8cb84457387bbb0599

    • SSDEEP

      6144:QGzRxSVtp0l6whGfsKR+zkBpTaa5tJHXhHANUTNd:jt0VPFfsKAkrbPlXhHANUTNd

    Score
    10/10
    gh0stratdiscoverypersistenceratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks