Overview

overview

10

Static

static

3348f46af3...52.exe

windows7-x64

10

3348f46af3...52.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3348f46af3929ede5226402d096a1198ca2ea0534f295679af8544c2f1bf4052

  • Size

    272KB

  • Sample

    221003-m6vmbadbfl

  • MD5

    688a79d23d73c139cfac17b16a228ea0

  • SHA1

    6afb5caa116323b789e84bda8627de4055c8e392

  • SHA256

    3348f46af3929ede5226402d096a1198ca2ea0534f295679af8544c2f1bf4052

  • SHA512

    a78f6e68a5fc805aa396c3d22b899aafc26f583bd2e14bb6720548eedfc228bf2e483acb9dc6559f8571af5966b846e0f302139b30b2f5906cb1e21e3f23f281

  • SSDEEP

    6144:rW0BgeX4QSE7M+l6BFV2KMsHleE8wUVsB:ZBgeX4xEIS6nV9HCwas

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      3348f46af3929ede5226402d096a1198ca2ea0534f295679af8544c2f1bf4052

    • Size

      272KB

    • MD5

      688a79d23d73c139cfac17b16a228ea0

    • SHA1

      6afb5caa116323b789e84bda8627de4055c8e392

    • SHA256

      3348f46af3929ede5226402d096a1198ca2ea0534f295679af8544c2f1bf4052

    • SHA512

      a78f6e68a5fc805aa396c3d22b899aafc26f583bd2e14bb6720548eedfc228bf2e483acb9dc6559f8571af5966b846e0f302139b30b2f5906cb1e21e3f23f281

    • SSDEEP

      6144:rW0BgeX4QSE7M+l6BFV2KMsHleE8wUVsB:ZBgeX4xEIS6nV9HCwas

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks