Overview

overview

10

Static

static

84ae8210cc...cd.exe

windows7-x64

10

84ae8210cc...cd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    84ae8210cc078e2962be9bb62ff3ff5eb2eaae7f87296a545803b18527521dcd

  • Size

    925KB

  • Sample

    221106-mg376ahggj

  • MD5

    394277e5e016005e96ded8342bfeb041

  • SHA1

    26762b55abd3f375dffb662ccf252901d82e2538

  • SHA256

    84ae8210cc078e2962be9bb62ff3ff5eb2eaae7f87296a545803b18527521dcd

  • SHA512

    ad73aa78852ee36e67546ecd1b106ab1bc88491ab7a73b154eee1a8d039879d88ec87fe371f2c4fcbcb1d2a3d254ebe0dc970f0d0c4261b2c88c12774c015311

  • SSDEEP

    24576:jkr7jT4WOCtG3r9WyErEwk664hq/ERAfHYI:jOIpj3r9WyEr04yEWvR

Score
10/10
gh0stratdiscoveryexploitrat

Malware Config

Targets

    • Target

      84ae8210cc078e2962be9bb62ff3ff5eb2eaae7f87296a545803b18527521dcd

    • Size

      925KB

    • MD5

      394277e5e016005e96ded8342bfeb041

    • SHA1

      26762b55abd3f375dffb662ccf252901d82e2538

    • SHA256

      84ae8210cc078e2962be9bb62ff3ff5eb2eaae7f87296a545803b18527521dcd

    • SHA512

      ad73aa78852ee36e67546ecd1b106ab1bc88491ab7a73b154eee1a8d039879d88ec87fe371f2c4fcbcb1d2a3d254ebe0dc970f0d0c4261b2c88c12774c015311

    • SSDEEP

      24576:jkr7jT4WOCtG3r9WyErEwk664hq/ERAfHYI:jOIpj3r9WyEr04yEWvR

    Score
    10/10
    gh0stratratdiscoveryexploit

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks