Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    eb118b4dfc58c978232dbb9f0aa9b8854f005460c1c3f0453edcec01e13ab484

  • Size

    114KB

  • Sample

    240606-tzfyxahf37

  • MD5

    c4a0cde1025bad5dc53dd73ec2b5ad4f

  • SHA1

    2860366d72aecc844f19382ef5abdc2a8a928b73

  • SHA256

    eb118b4dfc58c978232dbb9f0aa9b8854f005460c1c3f0453edcec01e13ab484

  • SHA512

    38e20cc7471d8fa4c0eeeadc1eac9bddfdc3b9689c4626dd07cf4b3c6366eeda0e66e025f19c23eddfe5d31205b94592c5e583cd7fd13ac3a63032d6dc62f2d9

  • SSDEEP

    3072:WyIpG2/iDbYVvgXdSeh17hBkPMmUZHO+B:XIposGo+OM/Zu

Malware Config

Extracted

Family

gh0strat

C2

110.40.43.81

Targets

    • Target

      eb118b4dfc58c978232dbb9f0aa9b8854f005460c1c3f0453edcec01e13ab484

    • Size

      114KB

    • MD5

      c4a0cde1025bad5dc53dd73ec2b5ad4f

    • SHA1

      2860366d72aecc844f19382ef5abdc2a8a928b73

    • SHA256

      eb118b4dfc58c978232dbb9f0aa9b8854f005460c1c3f0453edcec01e13ab484

    • SHA512

      38e20cc7471d8fa4c0eeeadc1eac9bddfdc3b9689c4626dd07cf4b3c6366eeda0e66e025f19c23eddfe5d31205b94592c5e583cd7fd13ac3a63032d6dc62f2d9

    • SSDEEP

      3072:WyIpG2/iDbYVvgXdSeh17hBkPMmUZHO+B:XIposGo+OM/Zu

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks