Overview

overview

10

Static

static

10

a9d600219f...cd.exe

windows7-x64

10

a9d600219f...cd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd

  • Size

    76KB

  • Sample

    220919-bg8bbsdhgl

  • MD5

    625a18ad5cc6c899205a15c09b2efc37

  • SHA1

    0fa112d6eb2eaabf7ed9f5ff3c665f491860369f

  • SHA256

    a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd

  • SHA512

    95c83500fb3d2ddcdb00b6bcd7c47677368ec67669e4d54bba7e682833d9293c84d7247d0402b1ea5077fa1a99123a03ec04f4337096c5f2b36b96f5d9daa0ce

  • SSDEEP

    1536:gX3HgJ+kgZj2N6WcPSQf3LeXFUHQqMuuQO:gX3H6vgZj2N6WsSq3LsFUHQTQO

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd

    • Size

      76KB

    • MD5

      625a18ad5cc6c899205a15c09b2efc37

    • SHA1

      0fa112d6eb2eaabf7ed9f5ff3c665f491860369f

    • SHA256

      a9d600219f781741acc330a123e102aff9570b30a3a9ce355687e299bff4e3cd

    • SHA512

      95c83500fb3d2ddcdb00b6bcd7c47677368ec67669e4d54bba7e682833d9293c84d7247d0402b1ea5077fa1a99123a03ec04f4337096c5f2b36b96f5d9daa0ce

    • SSDEEP

      1536:gX3HgJ+kgZj2N6WcPSQf3LeXFUHQqMuuQO:gX3H6vgZj2N6WsSq3LsFUHQTQO

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks