Overview

overview

10

Static

static

a20c7d4fa5...d8.exe

windows7-x64

10

a20c7d4fa5...d8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a20c7d4fa5269e46333af14f04b123aeb19073f750864360216e5654853be1d8

  • Size

    124KB

  • Sample

    221004-bz35bsfgaq

  • MD5

    6a2e8f641412ab66f41f12f2dcd515b0

  • SHA1

    db4fd6906aa004399d283fc8f93e34211a3b59c9

  • SHA256

    a20c7d4fa5269e46333af14f04b123aeb19073f750864360216e5654853be1d8

  • SHA512

    a6cfe5818baeb628785c415131771329596752130a3f6e9a9ebc1a82a3759838102fc6b088c8a1ba814b6648cca835afa5a149d512f466acca9a7219b467e49e

  • SSDEEP

    3072:G88ntGxqRm0u6xjDKv+gYW589xGgz2tHkDrlJ9ZLk:JgO6MpVi/bOHMf

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      a20c7d4fa5269e46333af14f04b123aeb19073f750864360216e5654853be1d8

    • Size

      124KB

    • MD5

      6a2e8f641412ab66f41f12f2dcd515b0

    • SHA1

      db4fd6906aa004399d283fc8f93e34211a3b59c9

    • SHA256

      a20c7d4fa5269e46333af14f04b123aeb19073f750864360216e5654853be1d8

    • SHA512

      a6cfe5818baeb628785c415131771329596752130a3f6e9a9ebc1a82a3759838102fc6b088c8a1ba814b6648cca835afa5a149d512f466acca9a7219b467e49e

    • SSDEEP

      3072:G88ntGxqRm0u6xjDKv+gYW589xGgz2tHkDrlJ9ZLk:JgO6MpVi/bOHMf

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks