Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

04fb1f5256...18.exe

windows7-x64

10

04fb1f5256...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04fb1f52568c65c6d033cf2c518f1261_JaffaCakes118

  • Size

    216KB

  • Sample

    241001-j3pp4stblh

  • MD5

    04fb1f52568c65c6d033cf2c518f1261

  • SHA1

    eb72be1e4db9b307f87989182fae6700dd9f7a78

  • SHA256

    5ec414a67742ca49ffa8b710295e643dcb01e348c1b40515033613113f20e5ff

  • SHA512

    526b3e04d20c9a33f545d1c02244e3b9aaccf72bbfa461c6fddddda1a97858041e00dfa5ef7914db92226d8c30cb7c8f482ba65d36a0821c5e7805322012ce04

  • SSDEEP

    3072:0VQZytihuXq2eobs76FkkvtpOqRnupBT8V1+Uc6uQ:vZoqXoc9WtFRupBT8V1+9fQ

Score
10/10
gh0stratdefense_evasiondiscoveryrat

Malware Config

Targets

    • Target

      04fb1f52568c65c6d033cf2c518f1261_JaffaCakes118

    • Size

      216KB

    • MD5

      04fb1f52568c65c6d033cf2c518f1261

    • SHA1

      eb72be1e4db9b307f87989182fae6700dd9f7a78

    • SHA256

      5ec414a67742ca49ffa8b710295e643dcb01e348c1b40515033613113f20e5ff

    • SHA512

      526b3e04d20c9a33f545d1c02244e3b9aaccf72bbfa461c6fddddda1a97858041e00dfa5ef7914db92226d8c30cb7c8f482ba65d36a0821c5e7805322012ce04

    • SSDEEP

      3072:0VQZytihuXq2eobs76FkkvtpOqRnupBT8V1+Uc6uQ:vZoqXoc9WtFRupBT8V1+9fQ

    Score
    10/10
    gh0stratdefense_evasiondiscoveryrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks