Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3e1fd8fc23...a2.exe

windows7-x64

10

3e1fd8fc23...a2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e1fd8fc235595bfcf42c47980616dc73b3e046cb8e47e1b518fcc79e34a7ba2

  • Size

    280KB

  • Sample

    221129-swxa2scb33

  • MD5

    a4e5787613503c79d51ccd921ef47fa4

  • SHA1

    f3a3b5a54aa6243bf7cf518daecbc1662c355cdf

  • SHA256

    3e1fd8fc235595bfcf42c47980616dc73b3e046cb8e47e1b518fcc79e34a7ba2

  • SHA512

    15ef18c7c324451ed24b6f0d3dcb7d3c41019471a04c1d16577f80d41869f78173d70879b537a646f49b0b49adbbda8e0b46e5a7a1a49fda0d32f641ae9bd193

  • SSDEEP

    6144:VR2zrtk4tfVryzVnnmt/cIl9qswB9bJ6dWbnziPcE1kQnd9frAALaFlez:Ontk45oJmt/cI6sAN0WC0zQndFrLky

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      3e1fd8fc235595bfcf42c47980616dc73b3e046cb8e47e1b518fcc79e34a7ba2

    • Size

      280KB

    • MD5

      a4e5787613503c79d51ccd921ef47fa4

    • SHA1

      f3a3b5a54aa6243bf7cf518daecbc1662c355cdf

    • SHA256

      3e1fd8fc235595bfcf42c47980616dc73b3e046cb8e47e1b518fcc79e34a7ba2

    • SHA512

      15ef18c7c324451ed24b6f0d3dcb7d3c41019471a04c1d16577f80d41869f78173d70879b537a646f49b0b49adbbda8e0b46e5a7a1a49fda0d32f641ae9bd193

    • SSDEEP

      6144:VR2zrtk4tfVryzVnnmt/cIl9qswB9bJ6dWbnziPcE1kQnd9frAALaFlez:Ontk45oJmt/cI6sAN0WC0zQndFrLky

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks