Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

a3662122e3...18.exe

windows7-x64

10

a3662122e3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a3662122e372cf1ad59a53c22884f27d_JaffaCakes118

  • Size

    109KB

  • Sample

    240817-vnbqgswgpf

  • MD5

    a3662122e372cf1ad59a53c22884f27d

  • SHA1

    a5c14979b2f82d6d503c090a11720a0f3a666358

  • SHA256

    43edd337b327b778969c87077e53d104802ea86ae30f34368d51f31d45aab06c

  • SHA512

    578feb3e0a5986aeb183bbd9108c6ca35479ca567ad61a4235d0bca3843c1ff2abf26780355264fdcb433fde042d00c48eebb1c15db0e75951be6640fc9ecab5

  • SSDEEP

    3072:O5+qt6yawwjQG0XuKJwVS7MOW76OrfCr70vUaHI:O4qt6yawwjQG4n0SpFODCrEUaHI

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      a3662122e372cf1ad59a53c22884f27d_JaffaCakes118

    • Size

      109KB

    • MD5

      a3662122e372cf1ad59a53c22884f27d

    • SHA1

      a5c14979b2f82d6d503c090a11720a0f3a666358

    • SHA256

      43edd337b327b778969c87077e53d104802ea86ae30f34368d51f31d45aab06c

    • SHA512

      578feb3e0a5986aeb183bbd9108c6ca35479ca567ad61a4235d0bca3843c1ff2abf26780355264fdcb433fde042d00c48eebb1c15db0e75951be6640fc9ecab5

    • SSDEEP

      3072:O5+qt6yawwjQG0XuKJwVS7MOW76OrfCr70vUaHI:O4qt6yawwjQG4n0SpFODCrEUaHI

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks