Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28

  • Size

    188KB

  • Sample

    221011-xfsedaacak

  • MD5

    68a99ea1ef20e1acac00762aeafdfad6

  • SHA1

    b872796b8e732d24dd60eaeab36b9e79ec4d05ac

  • SHA256

    015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28

  • SHA512

    2cbd169e31fa373670551b5bac1f3f147736f8eea5fba63b2b04aad6efe9c0a217337a59a2f0b17e5de915f36d4c6f57df72789dba010364f1985c6d604bec06

  • SSDEEP

    3072:boWoZusJKTS2eCaf+Tob4Vm1bKFSGDQIKvbBUWiFqX56WdIjcVwOyq:boWoZueK3j+mosf10RbGfFS56Wd0crn

Malware Config

Targets

    • Target

      015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28

    • Size

      188KB

    • MD5

      68a99ea1ef20e1acac00762aeafdfad6

    • SHA1

      b872796b8e732d24dd60eaeab36b9e79ec4d05ac

    • SHA256

      015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28

    • SHA512

      2cbd169e31fa373670551b5bac1f3f147736f8eea5fba63b2b04aad6efe9c0a217337a59a2f0b17e5de915f36d4c6f57df72789dba010364f1985c6d604bec06

    • SSDEEP

      3072:boWoZusJKTS2eCaf+Tob4Vm1bKFSGDQIKvbBUWiFqX56WdIjcVwOyq:boWoZueK3j+mosf10RbGfFS56Wd0crn

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Sets DLL path for service in the registry

    • Deletes itself

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks