General
-
Target
064b748205bc03cb1a95d6e0b1b3f5b5b16def1e13cd6e7f7b0a4a53f7b33b8d
-
Size
28KB
-
Sample
221104-158dnsbeg8
-
MD5
50a4aa611de41bb19fb211c2d2ceb484
-
SHA1
e1a916a211e86fc6696120c5e500e7a67a5b5f20
-
SHA256
064b748205bc03cb1a95d6e0b1b3f5b5b16def1e13cd6e7f7b0a4a53f7b33b8d
-
SHA512
4a5f1c5d8216e22c587d1716544c6299d03346f560971d727e9ffe7aa5abfac8ba9662c5a128a20eab731e9315801b44ee108459b0e9730b24e3641d15d2d821
-
SSDEEP
768:kPCjlBNB+BFBoBsB4BTBXBACf6oLjEMcaNoNl9/NOIT:GAt/CF/d
Malware Config
Targets
-
-
Target
064b748205bc03cb1a95d6e0b1b3f5b5b16def1e13cd6e7f7b0a4a53f7b33b8d
-
Size
28KB
-
MD5
50a4aa611de41bb19fb211c2d2ceb484
-
SHA1
e1a916a211e86fc6696120c5e500e7a67a5b5f20
-
SHA256
064b748205bc03cb1a95d6e0b1b3f5b5b16def1e13cd6e7f7b0a4a53f7b33b8d
-
SHA512
4a5f1c5d8216e22c587d1716544c6299d03346f560971d727e9ffe7aa5abfac8ba9662c5a128a20eab731e9315801b44ee108459b0e9730b24e3641d15d2d821
-
SSDEEP
768:kPCjlBNB+BFBoBsB4BTBXBACf6oLjEMcaNoNl9/NOIT:GAt/CF/d
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
UAC bypass
-
joker
Joker is an Android malware that targets billing and SMS fraud.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-