Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

1f563342e0...ec.exe

windows7-x64

10

1f563342e0...ec.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1f563342e0e196e9e4902bb5f4b5077c40e632d80f5b4c9a9ee5919fafcd2eec

  • Size

    204KB

  • Sample

    221129-sarhnsda8w

  • MD5

    3cc5633a1c10621a9f34cae49cee1d48

  • SHA1

    f20a294698f474d3c1f86a1a8738ca38af7cf7e7

  • SHA256

    1f563342e0e196e9e4902bb5f4b5077c40e632d80f5b4c9a9ee5919fafcd2eec

  • SHA512

    bf3246c24e67a0ee407794069585993a44add2376d1ba81fac4c8aac716739d733fceb91c551b5b43de74fc0cc59c7ece54c6125c109a17c303deacce37b3610

  • SSDEEP

    3072:ArBaHAhAtPf6BWHWVXhqPEzO/V1VrNYQkCA+HFSWvF3TBftEnob2RI:8uAh/WHv9DNYtEHhvF3TBlEnob/

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      1f563342e0e196e9e4902bb5f4b5077c40e632d80f5b4c9a9ee5919fafcd2eec

    • Size

      204KB

    • MD5

      3cc5633a1c10621a9f34cae49cee1d48

    • SHA1

      f20a294698f474d3c1f86a1a8738ca38af7cf7e7

    • SHA256

      1f563342e0e196e9e4902bb5f4b5077c40e632d80f5b4c9a9ee5919fafcd2eec

    • SHA512

      bf3246c24e67a0ee407794069585993a44add2376d1ba81fac4c8aac716739d733fceb91c551b5b43de74fc0cc59c7ece54c6125c109a17c303deacce37b3610

    • SSDEEP

      3072:ArBaHAhAtPf6BWHWVXhqPEzO/V1VrNYQkCA+HFSWvF3TBftEnob2RI:8uAh/WHv9DNYtEHhvF3TBlEnob/

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks