Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

a28fea6463...18.exe

windows7-x64

10

a28fea6463...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a28fea64630c9be2bd9c0e4ecc8abe91_JaffaCakes118

  • Size

    384KB

  • Sample

    240817-pt98cawbld

  • MD5

    a28fea64630c9be2bd9c0e4ecc8abe91

  • SHA1

    777e5ffd98706cbdd9aa1d40f5ad34dc8df8e8dc

  • SHA256

    b3f4143381141c86942012898ad26ee8b495d8567471bf8322259d9612c6b240

  • SHA512

    9ce00dce9940876f92cefc20135c21ff0f948d5e605006c1b8754ddd3198fa710638fd32196434a9c1da79b2f5d9751249d839e2f32257920392ac5323273d99

  • SSDEEP

    12288:KPdK4bgeK8VL5TKjb31wgxllhz7G60i2qvyOt:KPBjK8VlYb3P9FZ

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      a28fea64630c9be2bd9c0e4ecc8abe91_JaffaCakes118

    • Size

      384KB

    • MD5

      a28fea64630c9be2bd9c0e4ecc8abe91

    • SHA1

      777e5ffd98706cbdd9aa1d40f5ad34dc8df8e8dc

    • SHA256

      b3f4143381141c86942012898ad26ee8b495d8567471bf8322259d9612c6b240

    • SHA512

      9ce00dce9940876f92cefc20135c21ff0f948d5e605006c1b8754ddd3198fa710638fd32196434a9c1da79b2f5d9751249d839e2f32257920392ac5323273d99

    • SSDEEP

      12288:KPdK4bgeK8VL5TKjb31wgxllhz7G60i2qvyOt:KPBjK8VlYb3P9FZ

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks