Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

17fbe3ef84...7e.dll

windows7-x64

10

17fbe3ef84...7e.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17fbe3ef84fe17adef2872809b1fcb5eb6c743f07b36a446df50d53d4ed1a27e

  • Size

    51KB

  • Sample

    240517-g4hxvadc81

  • MD5

    b41782b87881b9456dcf1d8e001c67c1

  • SHA1

    c4f082055d64e1263384aa0ae67b4230ef09ebca

  • SHA256

    17fbe3ef84fe17adef2872809b1fcb5eb6c743f07b36a446df50d53d4ed1a27e

  • SHA512

    bc8f5683b04c2e676e9fbda96c5e14670ca4bac9fe33a1f8f06237ac54405d0e8b8486aab183b61d4ef6c46b43eeb7ca95561e6dbfec73a7d0c4ba23ed5b7155

  • SSDEEP

    1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLPJYH5:1dWubF3n9S91BF3fborJYH5

Score
10/10
gh0stratrat

Malware Config

Extracted

Family

gh0strat

C2

kinh.xmcxmr.com

Targets

    • Target

      17fbe3ef84fe17adef2872809b1fcb5eb6c743f07b36a446df50d53d4ed1a27e

    • Size

      51KB

    • MD5

      b41782b87881b9456dcf1d8e001c67c1

    • SHA1

      c4f082055d64e1263384aa0ae67b4230ef09ebca

    • SHA256

      17fbe3ef84fe17adef2872809b1fcb5eb6c743f07b36a446df50d53d4ed1a27e

    • SHA512

      bc8f5683b04c2e676e9fbda96c5e14670ca4bac9fe33a1f8f06237ac54405d0e8b8486aab183b61d4ef6c46b43eeb7ca95561e6dbfec73a7d0c4ba23ed5b7155

    • SSDEEP

      1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLPJYH5:1dWubF3n9S91BF3fborJYH5

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks