General
-
Target
96672d7f01e0888a1027ea0e5d8ef21fddc6da10a7d975eac592c22d2fa47125
-
Size
133KB
-
Sample
221003-m6xrnsdah2
-
MD5
6030c3f474453e7e13186eb36bf625d0
-
SHA1
47a49f4591f1336b9103024c397962a3e2888a50
-
SHA256
96672d7f01e0888a1027ea0e5d8ef21fddc6da10a7d975eac592c22d2fa47125
-
SHA512
c15655e83130123e7b2cf579a3388b35019e8a8b08dec074f0f1d8841a54ca810f4bf22e28765c4f2797f3fbc506a0ea3fe19af9fe3db6963d4602cadf49559c
-
SSDEEP
3072:Fq1mYgjLlBh3au3KsnmseiHootC4nTncmpLh9mZUbqTYbPnZY:oDkLlnau3fEiHosCuoUeMbC
Static task
static1
Behavioral task
behavioral1
Sample
96672d7f01e0888a1027ea0e5d8ef21fddc6da10a7d975eac592c22d2fa47125.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
96672d7f01e0888a1027ea0e5d8ef21fddc6da10a7d975eac592c22d2fa47125.exe
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
96672d7f01e0888a1027ea0e5d8ef21fddc6da10a7d975eac592c22d2fa47125
-
Size
133KB
-
MD5
6030c3f474453e7e13186eb36bf625d0
-
SHA1
47a49f4591f1336b9103024c397962a3e2888a50
-
SHA256
96672d7f01e0888a1027ea0e5d8ef21fddc6da10a7d975eac592c22d2fa47125
-
SHA512
c15655e83130123e7b2cf579a3388b35019e8a8b08dec074f0f1d8841a54ca810f4bf22e28765c4f2797f3fbc506a0ea3fe19af9fe3db6963d4602cadf49559c
-
SSDEEP
3072:Fq1mYgjLlBh3au3KsnmseiHootC4nTncmpLh9mZUbqTYbPnZY:oDkLlnau3fEiHosCuoUeMbC
Score10/10-
Gh0st RAT payload
-
Executes dropped EXE
-
Sets DLL path for service in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-