Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2
-
Size
1.0MB
-
Sample
230921-a25khabe5t
-
MD5
2e7b56329ff02982ce0ed6cc645a22e7
-
SHA1
c04483bf2fe79280b7062198a0ab42e0cb3bccbc
-
SHA256
9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2
-
SHA512
e9f24c855a5140085f2863735f0d867be1167cea7573963480478c62220dc8ed8940ea915d47e9814f4de1e80a1e28161169a84dc1d7ab47f28aae98bae8d45e
-
SSDEEP
12288:R1ec/eFqGZyUgCraUIk2yFqR+lIaaiEOqN/L0FgEhBCpJJNn8/MPr4OsnM:be7qGEUgCPr24qR+aaHEx/wFvUPEOs
Static task
static1
Behavioral task
behavioral1
Sample
9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2.exe
Resource
win10v2004-20230915-en
Malware Config
Extracted
gh0strat
47.97.163.157
Targets
-
-
Target
9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2
-
Size
1.0MB
-
MD5
2e7b56329ff02982ce0ed6cc645a22e7
-
SHA1
c04483bf2fe79280b7062198a0ab42e0cb3bccbc
-
SHA256
9d62aa6094a6e093b4442cf900b115df53ee0970fc5867c416096483fc7232a2
-
SHA512
e9f24c855a5140085f2863735f0d867be1167cea7573963480478c62220dc8ed8940ea915d47e9814f4de1e80a1e28161169a84dc1d7ab47f28aae98bae8d45e
-
SSDEEP
12288:R1ec/eFqGZyUgCraUIk2yFqR+lIaaiEOqN/L0FgEhBCpJJNn8/MPr4OsnM:be7qGEUgCPr24qR+aaHEx/wFvUPEOs
Score10/10-
Gh0st RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-