Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

16d78851ab...67.exe

windows7-x64

10

16d78851ab...67.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    16d78851abf55ad41ffe4e9059b6eb6b3fb6c41231f906c23b930e1103dd0867

  • Size

    4.7MB

  • Sample

    240524-e68vyadd93

  • MD5

    4cb7798fbecc4204059ea65774535c07

  • SHA1

    13b5a5efd92375434c30bff55b9b6654105c1e36

  • SHA256

    16d78851abf55ad41ffe4e9059b6eb6b3fb6c41231f906c23b930e1103dd0867

  • SHA512

    4f5ce5bc0403a860749c3259a75339fcf6836dac1f2b6222d8a7c8c059ce0d00ec084852b605d82f164f9886a95b24e89663fee0544336643dfceebf347d207c

  • SSDEEP

    49152:cYREXSVMKi39PbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PL:l2SVMK89PbXsPN5kiQaZ56

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      16d78851abf55ad41ffe4e9059b6eb6b3fb6c41231f906c23b930e1103dd0867

    • Size

      4.7MB

    • MD5

      4cb7798fbecc4204059ea65774535c07

    • SHA1

      13b5a5efd92375434c30bff55b9b6654105c1e36

    • SHA256

      16d78851abf55ad41ffe4e9059b6eb6b3fb6c41231f906c23b930e1103dd0867

    • SHA512

      4f5ce5bc0403a860749c3259a75339fcf6836dac1f2b6222d8a7c8c059ce0d00ec084852b605d82f164f9886a95b24e89663fee0544336643dfceebf347d207c

    • SSDEEP

      49152:cYREXSVMKi39PbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PL:l2SVMK89PbXsPN5kiQaZ56

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks