Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

6bfaf13f19...46.exe

windows7-x64

10

6bfaf13f19...46.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6bfaf13f199eea66483a44878dd5a646

  • Size

    96KB

  • Sample

    231226-nyerkagbd8

  • MD5

    6bfaf13f199eea66483a44878dd5a646

  • SHA1

    03b73d5de0bb7fc3d5ec5c70b32a66f73db5583b

  • SHA256

    26cf8c53b438bd1329b6b45f9b6fb146458c889a4e5dbcd88e4cf393c4676cee

  • SHA512

    eef57fd4e021b5005699e7cba367377c0ee0b051a2fc66c28fb8dc78704838df6ce0002c8d8a41ac6942ee1724ece8b7e53640bc9c54a385859092104042a2f5

  • SSDEEP

    1536:B5FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prnRJiCTSv7ZU:BvS4jHS8q/3nTzePCwNUh4E9zi/zZU

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      6bfaf13f199eea66483a44878dd5a646

    • Size

      96KB

    • MD5

      6bfaf13f199eea66483a44878dd5a646

    • SHA1

      03b73d5de0bb7fc3d5ec5c70b32a66f73db5583b

    • SHA256

      26cf8c53b438bd1329b6b45f9b6fb146458c889a4e5dbcd88e4cf393c4676cee

    • SHA512

      eef57fd4e021b5005699e7cba367377c0ee0b051a2fc66c28fb8dc78704838df6ce0002c8d8a41ac6942ee1724ece8b7e53640bc9c54a385859092104042a2f5

    • SSDEEP

      1536:B5FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prnRJiCTSv7ZU:BvS4jHS8q/3nTzePCwNUh4E9zi/zZU

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks