Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    04873d414d4cd4d41ae4d3dff098a2b4260be73d92a7efb139d1677b0cb6e623

  • Size

    684KB

  • Sample

    240503-rm9z4sha9v

  • MD5

    1bd41a4925226862a9dd18abce9515d5

  • SHA1

    cdcbdb66ca67c511774c4ffa06d7e954e2b25136

  • SHA256

    04873d414d4cd4d41ae4d3dff098a2b4260be73d92a7efb139d1677b0cb6e623

  • SHA512

    39349596911102ad081ab91230ed0af2d69ccb9887a47bdd9c869cc13858aae8c7d523b7ef4cd7988cbd4dafd2edc576a4ebc9b4416ff57a0e6849d847a0395d

  • SSDEEP

    3072:ScK/yLrQbWaR5Qax8c/YtZGx0gLY9eHVU2NYYKtjTtnbaUllllllllllllllpsx9:SXyLEbWaR5CcSAYYm2+tbLy

Malware Config

Extracted

Family

gh0strat

C2

117.18.15.248

Targets

    • Target

      04873d414d4cd4d41ae4d3dff098a2b4260be73d92a7efb139d1677b0cb6e623

    • Size

      684KB

    • MD5

      1bd41a4925226862a9dd18abce9515d5

    • SHA1

      cdcbdb66ca67c511774c4ffa06d7e954e2b25136

    • SHA256

      04873d414d4cd4d41ae4d3dff098a2b4260be73d92a7efb139d1677b0cb6e623

    • SHA512

      39349596911102ad081ab91230ed0af2d69ccb9887a47bdd9c869cc13858aae8c7d523b7ef4cd7988cbd4dafd2edc576a4ebc9b4416ff57a0e6849d847a0395d

    • SSDEEP

      3072:ScK/yLrQbWaR5Qax8c/YtZGx0gLY9eHVU2NYYKtjTtnbaUllllllllllllllpsx9:SXyLEbWaR5CcSAYYm2+tbLy

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks