Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

bfe098da37...bb.exe

windows7-x64

10

bfe098da37...bb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bfe098da37f3cc3ef08e7cefc2b000a1043ff2b1819cc9d1771bc628f5e98fbb

  • Size

    2.3MB

  • Sample

    230831-p62rqsfb85

  • MD5

    0d004b7cca6b78d29c628532127754e9

  • SHA1

    3fdb73a40f075e33aaf18008b35be817c10b9977

  • SHA256

    bfe098da37f3cc3ef08e7cefc2b000a1043ff2b1819cc9d1771bc628f5e98fbb

  • SHA512

    450fcd7863ca9ea6c02ed6181a547a32bb08124079c7b2dccd62ca71bf564e22d7ed0fd23f4c77bbd34b462d027fff452a9e1dc11cc4b0a146d388207b7f88d7

  • SSDEEP

    49152:QAR6pHImCXi45lSevpEie7zoQY49aXZmMAXh4plixja8dTeJPlXmB+giUS:QwI7Wl5Yei1ox49unmJZa8d6JPlXDgiz

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      bfe098da37f3cc3ef08e7cefc2b000a1043ff2b1819cc9d1771bc628f5e98fbb

    • Size

      2.3MB

    • MD5

      0d004b7cca6b78d29c628532127754e9

    • SHA1

      3fdb73a40f075e33aaf18008b35be817c10b9977

    • SHA256

      bfe098da37f3cc3ef08e7cefc2b000a1043ff2b1819cc9d1771bc628f5e98fbb

    • SHA512

      450fcd7863ca9ea6c02ed6181a547a32bb08124079c7b2dccd62ca71bf564e22d7ed0fd23f4c77bbd34b462d027fff452a9e1dc11cc4b0a146d388207b7f88d7

    • SSDEEP

      49152:QAR6pHImCXi45lSevpEie7zoQY49aXZmMAXh4plixja8dTeJPlXmB+giUS:QwI7Wl5Yei1ox49unmJZa8d6JPlXDgiz

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks