Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

015645b508...28.exe

windows7-x64

10

015645b508...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28

  • Size

    188KB

  • Sample

    221011-xfsedaacak

  • MD5

    68a99ea1ef20e1acac00762aeafdfad6

  • SHA1

    b872796b8e732d24dd60eaeab36b9e79ec4d05ac

  • SHA256

    015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28

  • SHA512

    2cbd169e31fa373670551b5bac1f3f147736f8eea5fba63b2b04aad6efe9c0a217337a59a2f0b17e5de915f36d4c6f57df72789dba010364f1985c6d604bec06

  • SSDEEP

    3072:boWoZusJKTS2eCaf+Tob4Vm1bKFSGDQIKvbBUWiFqX56WdIjcVwOyq:boWoZueK3j+mosf10RbGfFS56Wd0crn

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28

    • Size

      188KB

    • MD5

      68a99ea1ef20e1acac00762aeafdfad6

    • SHA1

      b872796b8e732d24dd60eaeab36b9e79ec4d05ac

    • SHA256

      015645b50837942ced50582e3b5164f848287b4e551ff34f30b67bf2c3fb9c28

    • SHA512

      2cbd169e31fa373670551b5bac1f3f147736f8eea5fba63b2b04aad6efe9c0a217337a59a2f0b17e5de915f36d4c6f57df72789dba010364f1985c6d604bec06

    • SSDEEP

      3072:boWoZusJKTS2eCaf+Tob4Vm1bKFSGDQIKvbBUWiFqX56WdIjcVwOyq:boWoZueK3j+mosf10RbGfFS56Wd0crn

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks