Overview

overview

10

Static

static

165b4cd047...3b.exe

windows7_x64

10

165b4cd047...3b.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    165b4cd047c192b68270335fe1dc6a3b.exe
  • Size 145KB
  • Sample220425-z1573sddd3
  • SHA256 ce9057071330e14edcb9a4ced48826ac5752c24219aa0db23229d23202eba283
  • MD5 SHA1 SHA512
Score
10/10
gh0stratratsuricata

Malware Config

Targets

    • Target
      165b4cd047c192b68270335fe1dc6a3b.exe
    • Size 145KB
    • SHA256 ce9057071330e14edcb9a4ced48826ac5752c24219aa0db23229d23202eba283
    • MD5 SHA1 SHA512
    Score
    10/10
    gh0stratratsuricata

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

      suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

      suricata

    • suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

      suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

      suricata

    • Blocklisted process makes network request

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks