Overview

overview

10

Static

static

0c36d1425d...36.exe

windows7-x64

8

0c36d1425d...36.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536

  • Size

    96KB

  • Sample

    221106-lrgapsgfbm

  • MD5

    209bad0e623e0ef809563c851005f298

  • SHA1

    498c4ec29c64c62c7eeb4c8a5b82df795d6a5909

  • SHA256

    0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536

  • SHA512

    86bfb1905a6859431b88213ae6099f526cfedc362ae65c1c679ccffeceffbd8cbb6ede8fa7bbef18b0a6d2c041871260abf00e2316e182f675344cbabd1d1c22

  • SSDEEP

    1536:CMFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prRmw2tRs/yn:CeS4jHS8q/3nTzePCwNUh4E9Rmw2Qyn

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536

    • Size

      96KB

    • MD5

      209bad0e623e0ef809563c851005f298

    • SHA1

      498c4ec29c64c62c7eeb4c8a5b82df795d6a5909

    • SHA256

      0c36d1425d56c6429df3b4a31490f0e246ff17cf38b2196180c293a916dfb536

    • SHA512

      86bfb1905a6859431b88213ae6099f526cfedc362ae65c1c679ccffeceffbd8cbb6ede8fa7bbef18b0a6d2c041871260abf00e2316e182f675344cbabd1d1c22

    • SSDEEP

      1536:CMFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prRmw2tRs/yn:CeS4jHS8q/3nTzePCwNUh4E9Rmw2Qyn

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks