Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cdd5f5e442...f9.exe

windows7-x64

10

cdd5f5e442...f9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cdd5f5e442c05bbe29f0aa009a1102850981829dc9952f2a5728057babc34df9

  • Size

    2.5MB

  • Sample

    230826-qbl88scc3v

  • MD5

    c39703887b3bb692f7939daf9a68910d

  • SHA1

    19d6d2de01fd72c6532974d54cb67cfdc00ddff5

  • SHA256

    cdd5f5e442c05bbe29f0aa009a1102850981829dc9952f2a5728057babc34df9

  • SHA512

    007f5b049f37277296398908185bcc462f07d261e6b63d4d9894fc1b99245b905d4c26f16ac50bd7d37ba4e3150c3bc3baabeb610b208e89f8629fc8a84edefb

  • SSDEEP

    49152:0CwsbCANnKXferL7Vwe/Gg0P+WhwaH+Zyn2k:Xws2ANnKXOaeOgmhwaSyn2k

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      cdd5f5e442c05bbe29f0aa009a1102850981829dc9952f2a5728057babc34df9

    • Size

      2.5MB

    • MD5

      c39703887b3bb692f7939daf9a68910d

    • SHA1

      19d6d2de01fd72c6532974d54cb67cfdc00ddff5

    • SHA256

      cdd5f5e442c05bbe29f0aa009a1102850981829dc9952f2a5728057babc34df9

    • SHA512

      007f5b049f37277296398908185bcc462f07d261e6b63d4d9894fc1b99245b905d4c26f16ac50bd7d37ba4e3150c3bc3baabeb610b208e89f8629fc8a84edefb

    • SSDEEP

      49152:0CwsbCANnKXferL7Vwe/Gg0P+WhwaH+Zyn2k:Xws2ANnKXOaeOgmhwaSyn2k

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks