gh0strat

General

Target
8E6AB3FA1FD0A8BCEF6B042CD9F0120847180EC1E57B1.exe
Size 1.2MB
Sample220423-hdggrsaha2
SHA256 8e6ab3fa1fd0a8bcef6b042cd9f0120847180ec1e57b10c28336ace670470e22
MD5 9b3e86fa835cd63b5887f4c51b786493
SHA1 d4d148b65a1fe525527772f2f51b41e43281fe40
SHA512 9050f7976a5ce61600ea4e2e83cfaea9aec43f28cc5a843062dd5fb0d2b2bf0b6c35ec22387b066e453790dd7c9c1e7e3f2b4f2d225c18fec65979d438629bce
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  8E6AB3FA1FD0A8BCEF6B042CD9F0120847180EC1E57B1.exe
- Size 1.2MB
- SHA256 8e6ab3fa1fd0a8bcef6b042cd9f0120847180ec1e57b10c28336ace670470e22
- MD5 9b3e86fa835cd63b5887f4c51b786493
- SHA1 d4d148b65a1fe525527772f2f51b41e43281fe40
- SHA512 9050f7976a5ce61600ea4e2e83cfaea9aec43f28cc5a843062dd5fb0d2b2bf0b6c35ec22387b066e453790dd7c9c1e7e3f2b4f2d225c18fec65979d438629bce
- MD5 SHA1 SHA512
Score

10^/10

gh0strat persistence rat suricata upx
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic
  suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic
  suricata
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Gh0st RAT payload

suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2