gh0strat | e3afbc09b473ebc206b3f6240867ce775d5a8d77a2608c1185fc61283d122f57 | Triage

Submit
Reports

Overview

overview

Static

static

e3afbc09b4...57.exe

windows7-x64

e3afbc09b4...57.exe

windows10-2004-x64

Sharing

General

Target

e3afbc09b473ebc206b3f6240867ce775d5a8d77a2608c1185fc61283d122f57
Size

109KB
Sample

221020-hdem6shgfm
MD5

42f0acf0c568c4ca88c244d03b355711
SHA1

7290672ae726de11013b9a66931dd1084e316985
SHA256

e3afbc09b473ebc206b3f6240867ce775d5a8d77a2608c1185fc61283d122f57
SHA512

407e90f3061c92c6a523d69dd37e7d7a080b99b969444c56df9c74c17bc73e0cdaf03e9da5906336cb5b6b764e07bc5dfa510c829847a33e322b49ad67d0e8cd
SSDEEP

1536:zVH8oMsa6kRfJirY84erfImafc61JfcUcKDRA8/HUtpFXCAIO:zZ8oVa6wiraf91JcUcw/HUtpFXCAIO

Score

10^/10

gh0strat persistence rat

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

e3afbc09b473ebc206b3f6240867ce775d5a8d77a2608c1185fc61283d122f57.exe

Resource

win7-20220812-en

gh0strat persistence rat

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

e3afbc09b473ebc206b3f6240867ce775d5a8d77a2608c1185fc61283d122f57.exe

Resource

win10v2004-20220901-en

gh0strat persistence rat

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  e3afbc09b473ebc206b3f6240867ce775d5a8d77a2608c1185fc61283d122f57
- Size
  
  109KB
- MD5
  
  42f0acf0c568c4ca88c244d03b355711
- SHA1
  
  7290672ae726de11013b9a66931dd1084e316985
- SHA256
  
  e3afbc09b473ebc206b3f6240867ce775d5a8d77a2608c1185fc61283d122f57
- SHA512
  
  407e90f3061c92c6a523d69dd37e7d7a080b99b969444c56df9c74c17bc73e0cdaf03e9da5906336cb5b6b764e07bc5dfa510c829847a33e322b49ad67d0e8cd
- SSDEEP
  
  1536:zVH8oMsa6kRfJirY84erfImafc61JfcUcKDRA8/HUtpFXCAIO:zZ8oVa6wiraf91JcUcw/HUtpFXCAIO
Score

10^/10

gh0strat persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Sets DLL path for service in the registry
  persistence
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratpersistencerat

behavioral2

gh0stratpersistencerat

© 2018-2024

Terms | Privacy