Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

a9ad72c409...b0.exe

windows7-x64

10

a9ad72c409...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a9ad72c409a9d0746fd59cc4d392d2b0.exe

  • Size

    395KB

  • Sample

    221221-qlmyhsfe2w

  • MD5

    a9ad72c409a9d0746fd59cc4d392d2b0

  • SHA1

    967bfc3d4980fd9a25002282119e36d87ff10be4

  • SHA256

    95fd93f3c2eb0bc7bbff95fb4e1e1df48486e67e025c0ff96b94a0e17add140b

  • SHA512

    40c67db8005b2621be9946e5d596cb09744f0caa1f617053bb8ab865e79836e8b029e700e2372120e00658829a01ad2cb0f6f7cb5441b48d63f807dcfaaa2b70

  • SSDEEP

    6144:vGHc//////7hwTB9RZEtXYP3MLJD4Qfwp85PpuRcxIsLoDkUtefOlEwa8x:qc//////dwTDbEyPLQfN71LoDxeXQ

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      a9ad72c409a9d0746fd59cc4d392d2b0.exe

    • Size

      395KB

    • MD5

      a9ad72c409a9d0746fd59cc4d392d2b0

    • SHA1

      967bfc3d4980fd9a25002282119e36d87ff10be4

    • SHA256

      95fd93f3c2eb0bc7bbff95fb4e1e1df48486e67e025c0ff96b94a0e17add140b

    • SHA512

      40c67db8005b2621be9946e5d596cb09744f0caa1f617053bb8ab865e79836e8b029e700e2372120e00658829a01ad2cb0f6f7cb5441b48d63f807dcfaaa2b70

    • SSDEEP

      6144:vGHc//////7hwTB9RZEtXYP3MLJD4Qfwp85PpuRcxIsLoDkUtefOlEwa8x:qc//////dwTDbEyPLQfN71LoDxeXQ

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks