Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
852dbeccb260f25345a93ed7feb376d324e16d8db04d13bcefa45f96e88dfd24
-
Size
1.2MB
-
Sample
250203-zld52ssqcs
-
MD5
7c79d98d8880878f0bc14e85fdee620c
-
SHA1
9a0b50550523817a7813ce085bf1f46e2f526dae
-
SHA256
852dbeccb260f25345a93ed7feb376d324e16d8db04d13bcefa45f96e88dfd24
-
SHA512
e54dcdeb102959c495c10a876f361db0da8ffb4fcef95bbbea8f9c96eb89f17736971f98edb21fe1b6720307d8018647bf147f9db5f821d5b1c8785e6c5aafc2
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiQ:WIwgMEuy+inDfp3/XoCw57XYBwKQ
Behavioral task
behavioral1
Sample
852dbeccb260f25345a93ed7feb376d324e16d8db04d13bcefa45f96e88dfd24.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
852dbeccb260f25345a93ed7feb376d324e16d8db04d13bcefa45f96e88dfd24
-
Size
1.2MB
-
MD5
7c79d98d8880878f0bc14e85fdee620c
-
SHA1
9a0b50550523817a7813ce085bf1f46e2f526dae
-
SHA256
852dbeccb260f25345a93ed7feb376d324e16d8db04d13bcefa45f96e88dfd24
-
SHA512
e54dcdeb102959c495c10a876f361db0da8ffb4fcef95bbbea8f9c96eb89f17736971f98edb21fe1b6720307d8018647bf147f9db5f821d5b1c8785e6c5aafc2
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiQ:WIwgMEuy+inDfp3/XoCw57XYBwKQ
-
Gh0st RAT payload
-
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory
-
Server Software Component: Terminal Services DLL
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2