Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2024-02-04...id.exe

windows7-x64

10

2024-02-04...id.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-02-04_2e6c2043d52211dde035bcde1a74a4d6_icedid

  • Size

    9.5MB

  • Sample

    240204-cvkmvshfhj

  • MD5

    2e6c2043d52211dde035bcde1a74a4d6

  • SHA1

    e71ea4d436c789af01c5416c2e1815bcdf717998

  • SHA256

    68a5375b61bf9a4fd4ff8d4f1ae13073391f60289f2efe8d83b297924b643ecd

  • SHA512

    686ac6211a439a8a4dde3424a48dde1c0b5ee728cd478c9dc64d935ccbc614e336c1ec8d9709e900e407f6da6d3fa7265859cdf94b7e50c91e3d40c760daefa3

  • SSDEEP

    24576:sHnmlJblvSdFP8THlhqe1khlqT6vpAj0qzswz5BJ:2mHz0TqevpGawzx

Score
10/10
gh0stratratupx

Malware Config

Targets

    • Target

      2024-02-04_2e6c2043d52211dde035bcde1a74a4d6_icedid

    • Size

      9.5MB

    • MD5

      2e6c2043d52211dde035bcde1a74a4d6

    • SHA1

      e71ea4d436c789af01c5416c2e1815bcdf717998

    • SHA256

      68a5375b61bf9a4fd4ff8d4f1ae13073391f60289f2efe8d83b297924b643ecd

    • SHA512

      686ac6211a439a8a4dde3424a48dde1c0b5ee728cd478c9dc64d935ccbc614e336c1ec8d9709e900e407f6da6d3fa7265859cdf94b7e50c91e3d40c760daefa3

    • SSDEEP

      24576:sHnmlJblvSdFP8THlhqe1khlqT6vpAj0qzswz5BJ:2mHz0TqevpGawzx

    Score
    10/10
    gh0stratratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Detects Windows executables referencing non-Windows User-Agents

    • Detects executables built or packed with MPress PE compressor

    • UPX dump on OEP (original entry point)

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks