Overview

overview

10

Static

static

ec827ffc56...50.exe

windows7-x64

10

ec827ffc56...50.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec827ffc5601ab5618483edb34adbce6ef5d70c5715118135890e2bcca8a6550

  • Size

    36KB

  • Sample

    220927-nlpq1adch9

  • MD5

    c71e89f8fc213c73ab59fc3e62c258f3

  • SHA1

    2dfb26333f75d629b21ccf50e3612b4a9e2c4a0f

  • SHA256

    ec827ffc5601ab5618483edb34adbce6ef5d70c5715118135890e2bcca8a6550

  • SHA512

    83960b66993ffb45b2962b38621ee67cb4a8b333dbb6d52d84cb88c61c7c27af0dac09210dfa8633b7f7455743203333392c9e7a89623478b33ba3c3bfdb5606

  • SSDEEP

    192:60RmaRBUda7n9JlU2g1jJMOEyKbIYymt5XTtEyKihoynlwHLHTgH9N2tpgRmd8MS:60oBdq9JGqO+NxhcAdN2tpgwd5ASc

Score
10/10
gh0stratevasionrattrojanupx

Malware Config

Targets

    • Target

      ec827ffc5601ab5618483edb34adbce6ef5d70c5715118135890e2bcca8a6550

    • Size

      36KB

    • MD5

      c71e89f8fc213c73ab59fc3e62c258f3

    • SHA1

      2dfb26333f75d629b21ccf50e3612b4a9e2c4a0f

    • SHA256

      ec827ffc5601ab5618483edb34adbce6ef5d70c5715118135890e2bcca8a6550

    • SHA512

      83960b66993ffb45b2962b38621ee67cb4a8b333dbb6d52d84cb88c61c7c27af0dac09210dfa8633b7f7455743203333392c9e7a89623478b33ba3c3bfdb5606

    • SSDEEP

      192:60RmaRBUda7n9JlU2g1jJMOEyKbIYymt5XTtEyKihoynlwHLHTgH9N2tpgRmd8MS:60oBdq9JGqO+NxhcAdN2tpgwd5ASc

    Score
    10/10
    evasiontrojangh0stratratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • UAC bypass

      evasiontrojan

    • Downloads MZ/PE file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • An obfuscated cmd.exe command-line is typically used to evade detection.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks