Overview

overview

10

Static

static

10

fd910b89c0...02.exe

windows7-x64

10

fd910b89c0...02.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fd910b89c0936361cb82b3f81749306237fec8cb219d7e91f0f065d35e93e102

  • Size

    304KB

  • Sample

    221020-t8dj5seae9

  • MD5

    9656fbbb87a33ff94613d537b0fdcee6

  • SHA1

    cf4893d87534915c1977e3a320fac06e105b40d4

  • SHA256

    fd910b89c0936361cb82b3f81749306237fec8cb219d7e91f0f065d35e93e102

  • SHA512

    0704b078607cd0a9972014fd8a25ac865edc60ee11a40787db343cb5ae00ceb4c301973e1b468e0fb738c28dee59a9a9041f1dba0aa1d52cf95353af8085960c

  • SSDEEP

    6144:o2Rnh5EsZm2E47RNYQRRV3A4G7UqqULirkT01:oeh5EsZY4dNPDCIrkw

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      fd910b89c0936361cb82b3f81749306237fec8cb219d7e91f0f065d35e93e102

    • Size

      304KB

    • MD5

      9656fbbb87a33ff94613d537b0fdcee6

    • SHA1

      cf4893d87534915c1977e3a320fac06e105b40d4

    • SHA256

      fd910b89c0936361cb82b3f81749306237fec8cb219d7e91f0f065d35e93e102

    • SHA512

      0704b078607cd0a9972014fd8a25ac865edc60ee11a40787db343cb5ae00ceb4c301973e1b468e0fb738c28dee59a9a9041f1dba0aa1d52cf95353af8085960c

    • SSDEEP

      6144:o2Rnh5EsZm2E47RNYQRRV3A4G7UqqULirkT01:oeh5EsZY4dNPDCIrkw

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks