Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    6ac1a3bdd906172a774fa64d06248d5a394daa53660249b867501af2a4d9e916

  • Size

    162KB

  • Sample

    221011-wvj6wahbcj

  • MD5

    6540da98c6bf8f8faa145222d5cc3870

  • SHA1

    135d89f6bd483af7ebe5f404c07ddbed539305df

  • SHA256

    6ac1a3bdd906172a774fa64d06248d5a394daa53660249b867501af2a4d9e916

  • SHA512

    84d3922116206182ead4dfc1aee3db736c83423a4ebf447750ff085044c8d4592530fddc97bf910a56324b161d742ce19bbc4649188b27660351c123e726148e

  • SSDEEP

    3072:6584GfIcKMq0FvNc4g441eja0doSji58hChiLotV:6mfI9MbFvNc4XkSjdot

Malware Config

Targets

    • Target

      6ac1a3bdd906172a774fa64d06248d5a394daa53660249b867501af2a4d9e916

    • Size

      162KB

    • MD5

      6540da98c6bf8f8faa145222d5cc3870

    • SHA1

      135d89f6bd483af7ebe5f404c07ddbed539305df

    • SHA256

      6ac1a3bdd906172a774fa64d06248d5a394daa53660249b867501af2a4d9e916

    • SHA512

      84d3922116206182ead4dfc1aee3db736c83423a4ebf447750ff085044c8d4592530fddc97bf910a56324b161d742ce19bbc4649188b27660351c123e726148e

    • SSDEEP

      3072:6584GfIcKMq0FvNc4g441eja0doSji58hChiLotV:6mfI9MbFvNc4XkSjdot

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Sets DLL path for service in the registry

    • Sets file execution options in registry

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks