Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
JaffaCakes118_663f92e63fe7a29d4253e40bc90f8c6b.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_663f92e63fe7a29d4253e40bc90f8c6b
-
Size
142KB
-
MD5
663f92e63fe7a29d4253e40bc90f8c6b
-
SHA1
4a583b99733d6d6a829585926b9baefcb75b3fba
-
SHA256
1a62e1effbfeb3dc0fe689df3b44d7331cdb5a10538b9db6ba21d639d384fdc1
-
SHA512
660772d6a2f0a6a63ded55885f2df4381bd7d3732f9b596a4600bebc2b15c6e84d308dd7874f178de3f6106cc0047dbf08245c24c4c6d7619f237abb26828996
-
SSDEEP
3072:Rmyquxs4bTzxLqh+lPmPouqJdP/EaN6a//rBNYQ:Rmyquxs4bTzx2h+VmtYPM0//D
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
JaffaCakes118_663f92e63fe7a29d4253e40bc90f8c6b.exe windows:4 windows x86 arch:x86
Code Sign
5a:97:6c:18:08:38:b8:fc:39:44:d4:af:e8:7c:81:7b:6c:f7:45:c3Signer
Actual PE Digest5a:97:6c:18:08:38:b8:fc:39:44:d4:af:e8:7c:81:7b:6c:f7:45:c3Digest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Exports
Exports
JustTempLMHKF00
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 117KB - Virtual size: 117KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
yuxuan Size: 188B - Virtual size: 188B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE