Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

7d45111be7...f8.exe

windows7-x64

10

7d45111be7...f8.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7d45111be7ad9138ea4bffccee926b1c295aaa5ebbe3b667fb608d8394a9f5f8

  • Size

    757KB

  • Sample

    221129-rde4dahh9v

  • MD5

    17a8ced7b6e0d1597c11436810c47630

  • SHA1

    d6d919f6b5eee002ab03d5ad99bfba2faf4ebec3

  • SHA256

    7d45111be7ad9138ea4bffccee926b1c295aaa5ebbe3b667fb608d8394a9f5f8

  • SHA512

    7355284bc2b389708724a2b92358fa456335d99a13a3c3138dc0f071363d3e4ca50c22d736372763f175b7ca6b6f274d2063f7ff5c814004b23bbfcd06a7e7d7

  • SSDEEP

    6144:QGzRxSVtp0l6whGfsKR+zkBpTaa5tJH7cHANUTNhGXc7nl/O:jt0VPFfsKAkrbPl7cHANUTNhGMA

Score
10/10
gh0stratpersistenceratupx

Malware Config

Targets

    • Target

      7d45111be7ad9138ea4bffccee926b1c295aaa5ebbe3b667fb608d8394a9f5f8

    • Size

      757KB

    • MD5

      17a8ced7b6e0d1597c11436810c47630

    • SHA1

      d6d919f6b5eee002ab03d5ad99bfba2faf4ebec3

    • SHA256

      7d45111be7ad9138ea4bffccee926b1c295aaa5ebbe3b667fb608d8394a9f5f8

    • SHA512

      7355284bc2b389708724a2b92358fa456335d99a13a3c3138dc0f071363d3e4ca50c22d736372763f175b7ca6b6f274d2063f7ff5c814004b23bbfcd06a7e7d7

    • SSDEEP

      6144:QGzRxSVtp0l6whGfsKR+zkBpTaa5tJH7cHANUTNhGXc7nl/O:jt0VPFfsKAkrbPl7cHANUTNhGMA

    Score
    10/10
    gh0stratpersistenceratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks