Overview

overview

10

Static

static

7AE15C1BFD...6F.exe

windows7_x64

10

7AE15C1BFD...6F.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe
  • Size 145KB
  • Sample220322-qdstssfdb2
  • SHA256 7ae15c1bfdf60a0b05efe8f2b0e0c70c1f7d8aaef456fc82efd1092bc687c7d7
  • MD5 SHA1 SHA512
Score
10/10
gh0stratratsuricata

Malware Config

Targets

    • Target
      7AE15C1BFDF60A0B05EFE8F2B0E0C70C1F7D8AAEF456F.exe
    • Size 145KB
    • SHA256 7ae15c1bfdf60a0b05efe8f2b0e0c70c1f7d8aaef456fc82efd1092bc687c7d7
    • MD5 SHA1 SHA512
    Score
    10/10
    gh0stratratsuricata

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

      suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

      suricata

    • suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

      suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

      suricata

    • Blocklisted process makes network request

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks