Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

5fdfcedab7...17.exe

windows7-x64

10

5fdfcedab7...17.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5fdfcedab73c819c7548d1e6dcbea52ebf6ea963a1e4093654039065a6b42c17

  • Size

    1.2MB

  • Sample

    241231-1nnypstlbk

  • MD5

    fe95d6ccc893720f518a37f830ae48b4

  • SHA1

    a6a9e7030410564de8a52b95a10df7a593fbce21

  • SHA256

    5fdfcedab73c819c7548d1e6dcbea52ebf6ea963a1e4093654039065a6b42c17

  • SHA512

    71b0896c80ac2142fbd8e8eb330c00af064ccc1369066835f53bf70ab8ebc1de434b1b5ad0209734de79b074e8078cf999d1d4344fdae7485fc7d5165c813d61

  • SSDEEP

    24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiO:WIwgMEuy+inDfp3/XoCw57XYBwKO

Score
10/10
gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupxvmprotect

Malware Config

Targets

    • Target

      5fdfcedab73c819c7548d1e6dcbea52ebf6ea963a1e4093654039065a6b42c17

    • Size

      1.2MB

    • MD5

      fe95d6ccc893720f518a37f830ae48b4

    • SHA1

      a6a9e7030410564de8a52b95a10df7a593fbce21

    • SHA256

      5fdfcedab73c819c7548d1e6dcbea52ebf6ea963a1e4093654039065a6b42c17

    • SHA512

      71b0896c80ac2142fbd8e8eb330c00af064ccc1369066835f53bf70ab8ebc1de434b1b5ad0209734de79b074e8078cf999d1d4344fdae7485fc7d5165c813d61

    • SSDEEP

      24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiO:WIwgMEuy+inDfp3/XoCw57XYBwKO

    Score
    10/10
    gh0stratpurplefoxdiscoverypersistenceratrootkittrojanupxvmprotect

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

      rootkit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

      rootkittrojanpurplefox

    • Purplefox family

      purplefox

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.