Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
NEAS.e30e947c000a0e11c6b8a285a7013cd10ea55af42be787c54822bd91d94c6400_JC.exe
-
Size
673KB
-
Sample
231006-zpkf8sfh9s
-
MD5
484ab79215e73743053556b128a60ef0
-
SHA1
74500943aec7c38764a6b7b6babf9ffbdd440c27
-
SHA256
e30e947c000a0e11c6b8a285a7013cd10ea55af42be787c54822bd91d94c6400
-
SHA512
e1ad76c0b0116c0431c9a3befdca6555df5ee0583474075720bf94c26ab9fa4e0ca582b9f28ba91a92080fa2b1677d7269ce6e970fa56abcb9dddc0364949356
-
SSDEEP
12288:FW5tTEdPGYqEOc4POXmH8GI0duC77jDb0PUH:F8Eo6OcUODWxTH
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.e30e947c000a0e11c6b8a285a7013cd10ea55af42be787c54822bd91d94c6400_JC.exe
Resource
win7-20230831-en
Malware Config
Targets
-
-
Target
NEAS.e30e947c000a0e11c6b8a285a7013cd10ea55af42be787c54822bd91d94c6400_JC.exe
-
Size
673KB
-
MD5
484ab79215e73743053556b128a60ef0
-
SHA1
74500943aec7c38764a6b7b6babf9ffbdd440c27
-
SHA256
e30e947c000a0e11c6b8a285a7013cd10ea55af42be787c54822bd91d94c6400
-
SHA512
e1ad76c0b0116c0431c9a3befdca6555df5ee0583474075720bf94c26ab9fa4e0ca582b9f28ba91a92080fa2b1677d7269ce6e970fa56abcb9dddc0364949356
-
SSDEEP
12288:FW5tTEdPGYqEOc4POXmH8GI0duC77jDb0PUH:F8Eo6OcUODWxTH
-
Gh0st RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-