Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

a95cfc6815...24.dll

windows7-x64

10

a95cfc6815...24.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a95cfc68156e784aafabb3069b302c77ec632871d0d9b71f5d995f305e691024

  • Size

    51KB

  • Sample

    240616-wvprcsvgkj

  • MD5

    eec70f6f10ab27abfe484dc022cb9364

  • SHA1

    70f492888b739bb1a81d44a21cd25cd3413b4222

  • SHA256

    a95cfc68156e784aafabb3069b302c77ec632871d0d9b71f5d995f305e691024

  • SHA512

    89f7ee76158806aab6c6a2b3a85ac8d722303cde14bba261cb68ead35cf0d0f3a2c628e2c2edfc10ce6cbe9c87ab934c6796877d93b2e340841e81610553dec5

  • SSDEEP

    1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLQJYH5:1dWubF3n9S91BF3fbocJYH5

Score
10/10
gh0stratrat

Malware Config

Extracted

Family

gh0strat

C2

kinh.xmcxmr.com

Targets

    • Target

      a95cfc68156e784aafabb3069b302c77ec632871d0d9b71f5d995f305e691024

    • Size

      51KB

    • MD5

      eec70f6f10ab27abfe484dc022cb9364

    • SHA1

      70f492888b739bb1a81d44a21cd25cd3413b4222

    • SHA256

      a95cfc68156e784aafabb3069b302c77ec632871d0d9b71f5d995f305e691024

    • SHA512

      89f7ee76158806aab6c6a2b3a85ac8d722303cde14bba261cb68ead35cf0d0f3a2c628e2c2edfc10ce6cbe9c87ab934c6796877d93b2e340841e81610553dec5

    • SSDEEP

      1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLQJYH5:1dWubF3n9S91BF3fbocJYH5

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks