Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

8a9e6475f4...89.dll

windows7-x64

3

8a9e6475f4...89.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8a9e6475f4e7d9bc078c13cdaacf45f316559b2e6c59f97bbc444289ffb3a489

  • Size

    137KB

  • Sample

    240904-asggbaseke

  • MD5

    6d81d6d7820b25c664dddedf472f34e1

  • SHA1

    cc2936780109e11a8155daf1b6ea56b99074a88c

  • SHA256

    8a9e6475f4e7d9bc078c13cdaacf45f316559b2e6c59f97bbc444289ffb3a489

  • SHA512

    d668784cdc962bea61cb6c4dfdd798ce4d63588e3fc607b8afca8ee692220b77d21ab7af4a73cc9bd6ec9a57ccd5b318cbae50761177b4d4c878a393459ae2e4

  • SSDEEP

    3072:wR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuC:V25GgFny61mraE

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      8a9e6475f4e7d9bc078c13cdaacf45f316559b2e6c59f97bbc444289ffb3a489

    • Size

      137KB

    • MD5

      6d81d6d7820b25c664dddedf472f34e1

    • SHA1

      cc2936780109e11a8155daf1b6ea56b99074a88c

    • SHA256

      8a9e6475f4e7d9bc078c13cdaacf45f316559b2e6c59f97bbc444289ffb3a489

    • SHA512

      d668784cdc962bea61cb6c4dfdd798ce4d63588e3fc607b8afca8ee692220b77d21ab7af4a73cc9bd6ec9a57ccd5b318cbae50761177b4d4c878a393459ae2e4

    • SSDEEP

      3072:wR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuC:V25GgFny61mraE

    Score
    10/10
    discoverygh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

      persistence

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks