Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e991b2a533...4c.exe

windows7-x64

10

e991b2a533...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e991b2a533dbec2853a00547d5158d9be1d432abc812937b9acd46155a9c204c

  • Size

    283KB

  • Sample

    250228-ek4n4a1pv5

  • MD5

    5568dd7f573dde864b800e2f4db0011f

  • SHA1

    b18f41952865be0e38a9f61702d6d72866a76626

  • SHA256

    e991b2a533dbec2853a00547d5158d9be1d432abc812937b9acd46155a9c204c

  • SHA512

    da06b1addde5f7f355da21a0f1ec8a96d6d0acb486ff06c27d5b67bf8351989877c9f7ca48f6b49fe8f3111c85b6ef3bf81b9674b93e7f061d2c21882ec954c4

  • SSDEEP

    6144:XhR0F/vfDPYvVVPVtN7EJtUHbQrokoauY5bXngqVX3MQ0x6fX65:a/nAhEJteQreLY5bXgI50xIK5

Score
10/10
gh0stratdiscoveryratupx

Malware Config

Targets

    • Target

      e991b2a533dbec2853a00547d5158d9be1d432abc812937b9acd46155a9c204c

    • Size

      283KB

    • MD5

      5568dd7f573dde864b800e2f4db0011f

    • SHA1

      b18f41952865be0e38a9f61702d6d72866a76626

    • SHA256

      e991b2a533dbec2853a00547d5158d9be1d432abc812937b9acd46155a9c204c

    • SHA512

      da06b1addde5f7f355da21a0f1ec8a96d6d0acb486ff06c27d5b67bf8351989877c9f7ca48f6b49fe8f3111c85b6ef3bf81b9674b93e7f061d2c21882ec954c4

    • SSDEEP

      6144:XhR0F/vfDPYvVVPVtN7EJtUHbQrokoauY5bXngqVX3MQ0x6fX65:a/nAhEJteQreLY5bXgI50xIK5

    Score
    10/10
    gh0stratdiscoveryratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks