Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e92a3fda7d80bdd8ae52cc4aebf13a1279fe413bd7c192658d37e4756ad20cbc

  • Size

    2.6MB

  • Sample

    241031-bqjpbswelm

  • MD5

    e7ed42ef03cea6db95b5dcdeb959b7af

  • SHA1

    61d2c0fed2ef771c981140176b7fde4dcd8ddef3

  • SHA256

    e92a3fda7d80bdd8ae52cc4aebf13a1279fe413bd7c192658d37e4756ad20cbc

  • SHA512

    62a7c2c5a5bbee3e5e12c0a797189cee325a2012eda20d0cb5bef94955ac1560e07ad616d5d258a6be236eb2ee5c2ec045457a4f9d91c4447916d2b973d31bc9

  • SSDEEP

    49152:mCwsbCANnKXferL7Vwe/Gg0P+WhNFFFehlady6:Rws2ANnKXOaeOgmhNFFFehladR

Malware Config

Targets

    • Target

      e92a3fda7d80bdd8ae52cc4aebf13a1279fe413bd7c192658d37e4756ad20cbc

    • Size

      2.6MB

    • MD5

      e7ed42ef03cea6db95b5dcdeb959b7af

    • SHA1

      61d2c0fed2ef771c981140176b7fde4dcd8ddef3

    • SHA256

      e92a3fda7d80bdd8ae52cc4aebf13a1279fe413bd7c192658d37e4756ad20cbc

    • SHA512

      62a7c2c5a5bbee3e5e12c0a797189cee325a2012eda20d0cb5bef94955ac1560e07ad616d5d258a6be236eb2ee5c2ec045457a4f9d91c4447916d2b973d31bc9

    • SSDEEP

      49152:mCwsbCANnKXferL7Vwe/Gg0P+WhNFFFehlady6:Rws2ANnKXOaeOgmhNFFFehladR

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Purplefox family

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Sets service image path in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.