Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    caaf7737db2eee2f58765deee38aabbdc6297a053dbcea09c75e8a7ed4d97fa9

  • Size

    1.2MB

  • Sample

    250103-w9ppxaxmb1

  • MD5

    3f19122c2dce6d110231cc214503cc8e

  • SHA1

    5841127e63cee15670418f8a312f10eed974a4a6

  • SHA256

    caaf7737db2eee2f58765deee38aabbdc6297a053dbcea09c75e8a7ed4d97fa9

  • SHA512

    8da4cfbcfba0993483b38dd50d66ce5820ee01dc74fccc057e8f974152d2bd425472b11297c4d5e01e5ccbb4b0e6865f945f8d97dc52d06da0f0e6b60ebea72d

  • SSDEEP

    24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiy:WIwgMEuy+inDfp3/XoCw57XYBwKy

Malware Config

Targets

    • Target

      caaf7737db2eee2f58765deee38aabbdc6297a053dbcea09c75e8a7ed4d97fa9

    • Size

      1.2MB

    • MD5

      3f19122c2dce6d110231cc214503cc8e

    • SHA1

      5841127e63cee15670418f8a312f10eed974a4a6

    • SHA256

      caaf7737db2eee2f58765deee38aabbdc6297a053dbcea09c75e8a7ed4d97fa9

    • SHA512

      8da4cfbcfba0993483b38dd50d66ce5820ee01dc74fccc057e8f974152d2bd425472b11297c4d5e01e5ccbb4b0e6865f945f8d97dc52d06da0f0e6b60ebea72d

    • SSDEEP

      24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiy:WIwgMEuy+inDfp3/XoCw57XYBwKy

    • Detect PurpleFox Rootkit

      Detect PurpleFox Rootkit.

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • PurpleFox

      PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    • Purplefox family

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

    • Adds Run key to start application

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.