Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

1a425c5603...b8.exe

windows7-x64

10

1a425c5603...b8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a425c5603c76007a5935a3036d884b8

  • Size

    192KB

  • Sample

    231230-qxc8fsaedn

  • MD5

    1a425c5603c76007a5935a3036d884b8

  • SHA1

    cad18af6cfbc3b8b9508316f7e1c02e3aa8ba4a3

  • SHA256

    df623b000d3c8ce0001450f34630d3b6a8c9793cfb3b95fcdf638751e83fd308

  • SHA512

    347ba6b40addc48c673513887e4765c64c1c8a59e3678363a6ebc32d5d34ad9ed9aeac68d67645c06c83bac804fd00d62204263472f467a310542ec4004e3cb2

  • SSDEEP

    3072:BVmshbnWBsdZCSf2JZdXs9k7u7nTsB2cyrda97eXMKQWzjLFFH9IKF5nivytqHmM:+sBnWBsdZCs4Zdp784gcyrJpQ7c

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      1a425c5603c76007a5935a3036d884b8

    • Size

      192KB

    • MD5

      1a425c5603c76007a5935a3036d884b8

    • SHA1

      cad18af6cfbc3b8b9508316f7e1c02e3aa8ba4a3

    • SHA256

      df623b000d3c8ce0001450f34630d3b6a8c9793cfb3b95fcdf638751e83fd308

    • SHA512

      347ba6b40addc48c673513887e4765c64c1c8a59e3678363a6ebc32d5d34ad9ed9aeac68d67645c06c83bac804fd00d62204263472f467a310542ec4004e3cb2

    • SSDEEP

      3072:BVmshbnWBsdZCSf2JZdXs9k7u7nTsB2cyrda97eXMKQWzjLFFH9IKF5nivytqHmM:+sBnWBsdZCs4Zdp784gcyrJpQ7c

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks