Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

6719251427...3c.exe

windows7-x64

10

6719251427...3c.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    67192514274aac738a2b014e7c8a913c

  • Size

    260KB

  • Sample

    240119-jv4jasade7

  • MD5

    67192514274aac738a2b014e7c8a913c

  • SHA1

    d5ed248403057efff3e8d717d1cf0f650d655790

  • SHA256

    5a1dd5d210d973e1bd4027e9a6fc16efe3dce6d8ed3dbd9c4a2463c0158687e0

  • SHA512

    6f4d56afd1a2a99bd011700a6eac284b5ef20d24bbf66d3180bde5aec060f2bbc716c155469f83388229117535fd1abd24f2952f32886fa2f6af77e786d6dead

  • SSDEEP

    6144:+wxvges2lBlZL02vIM/N5gAshXqBdYHEzodHVe4C7:lvges2lBlOA9/oAspqBqHEzo1Ve4C7

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      67192514274aac738a2b014e7c8a913c

    • Size

      260KB

    • MD5

      67192514274aac738a2b014e7c8a913c

    • SHA1

      d5ed248403057efff3e8d717d1cf0f650d655790

    • SHA256

      5a1dd5d210d973e1bd4027e9a6fc16efe3dce6d8ed3dbd9c4a2463c0158687e0

    • SHA512

      6f4d56afd1a2a99bd011700a6eac284b5ef20d24bbf66d3180bde5aec060f2bbc716c155469f83388229117535fd1abd24f2952f32886fa2f6af77e786d6dead

    • SSDEEP

      6144:+wxvges2lBlZL02vIM/N5gAshXqBdYHEzodHVe4C7:lvges2lBlOA9/oAspqBqHEzo1Ve4C7

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks