Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...59.exe

windows7-x64

10

JaffaCakes...59.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_62c284e413906e5db4d7c4e5291c8c59

  • Size

    320KB

  • Sample

    250311-c8kvsaxq12

  • MD5

    62c284e413906e5db4d7c4e5291c8c59

  • SHA1

    8ed758d0abf36b57c5ab6e7485eface4180e3730

  • SHA256

    9f587ce911e0af79e44c483392ea3eeea4c0367c0af133fe984a30d0caee1627

  • SHA512

    1e3ed9fb3c443cb1e16925a19b5bf9b285843315e5e667be0dfc1f4615f30af3499a68378ee1458565ca8c7ae2222937f3d368e41087c72286820936745f1964

  • SSDEEP

    6144:IvM/Haymfu4nDWgRAkPD2GQn8xID0DMF3kBydfSN5ndyaizYuyLn5:p6DR3PD2GLxe0Dvya5n3ize

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_62c284e413906e5db4d7c4e5291c8c59

    • Size

      320KB

    • MD5

      62c284e413906e5db4d7c4e5291c8c59

    • SHA1

      8ed758d0abf36b57c5ab6e7485eface4180e3730

    • SHA256

      9f587ce911e0af79e44c483392ea3eeea4c0367c0af133fe984a30d0caee1627

    • SHA512

      1e3ed9fb3c443cb1e16925a19b5bf9b285843315e5e667be0dfc1f4615f30af3499a68378ee1458565ca8c7ae2222937f3d368e41087c72286820936745f1964

    • SSDEEP

      6144:IvM/Haymfu4nDWgRAkPD2GQn8xID0DMF3kBydfSN5ndyaizYuyLn5:p6DR3PD2GLxe0Dvya5n3ize

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks