Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5f08a4371f...f9.exe

windows7-x64

10

5f08a4371f...f9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9

  • Size

    3.2MB

  • Sample

    231012-kbe72aah95

  • MD5

    d18f878cd976e18f23b19c0a6809df06

  • SHA1

    1a3a31612889de8d194289ff0d20be4e7373ff38

  • SHA256

    5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9

  • SHA512

    a1a3df4db86746f790be8b516559cdc4e30b82f677c0c97d8de532f761601497d4e581b25c61bd041fc170f347821a233a9088c37a1fbfdc39362364444fa4b3

  • SSDEEP

    49152:p89XJt4HIZ/Gg0P+Wh81iWwV9wxTeIJtk5/IjTf5GelUXKerOmhis:OZJt4HIZOgmh8AvodLJtk/elc

Score
10/10
gh0stratpurplefoxpersistenceratrootkittrojanupx

Malware Config

Targets

    • Target

      5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9

    • Size

      3.2MB

    • MD5

      d18f878cd976e18f23b19c0a6809df06

    • SHA1

      1a3a31612889de8d194289ff0d20be4e7373ff38

    • SHA256

      5f08a4371f92a4909358f0b7cd8fb9023a69517e026e0cbea82d7a30f9739cf9

    • SHA512

      a1a3df4db86746f790be8b516559cdc4e30b82f677c0c97d8de532f761601497d4e581b25c61bd041fc170f347821a233a9088c37a1fbfdc39362364444fa4b3

    • SSDEEP

      49152:p89XJt4HIZ/Gg0P+Wh81iWwV9wxTeIJtk5/IjTf5GelUXKerOmhis:OZJt4HIZOgmh8AvodLJtk/elc

    Score
    10/10
    gh0stratpurplefoxpersistenceratrootkittrojanupx

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks