Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

a46fc27322...7d.exe

windows7-x64

10

a46fc27322...7d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a46fc273226d0ef8cc8cd79ff08bd7cf5bb43f5d584cc42c197f0cb49bbca17d

  • Size

    783KB

  • Sample

    221202-zrqe9sdb99

  • MD5

    735f0f706afd0913eff44095eea10e31

  • SHA1

    5ef1b959ccaf5364663d1056b87fe1ebf85fea51

  • SHA256

    a46fc273226d0ef8cc8cd79ff08bd7cf5bb43f5d584cc42c197f0cb49bbca17d

  • SHA512

    32c930576362d68b46b4ab2a5392f63183425b49a8145217eebc19fae70dbbe30d7c1f07abc74b02ed97b8af928de3f299c8fecad12300420aa62e09372345a5

  • SSDEEP

    12288:jfoZQG1PyUwGh3Q9xRQpR3PvGLxe0DMwRoZQp1PyUwGhxYV:Tod1twGwkR3PIx7DBoe1twGC

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      a46fc273226d0ef8cc8cd79ff08bd7cf5bb43f5d584cc42c197f0cb49bbca17d

    • Size

      783KB

    • MD5

      735f0f706afd0913eff44095eea10e31

    • SHA1

      5ef1b959ccaf5364663d1056b87fe1ebf85fea51

    • SHA256

      a46fc273226d0ef8cc8cd79ff08bd7cf5bb43f5d584cc42c197f0cb49bbca17d

    • SHA512

      32c930576362d68b46b4ab2a5392f63183425b49a8145217eebc19fae70dbbe30d7c1f07abc74b02ed97b8af928de3f299c8fecad12300420aa62e09372345a5

    • SSDEEP

      12288:jfoZQG1PyUwGh3Q9xRQpR3PvGLxe0DMwRoZQp1PyUwGhxYV:Tod1twGwkR3PIx7DBoe1twGC

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks