Overview

overview

10

Static

static

6ccb2248ec...60.exe

windows7-x64

10

6ccb2248ec...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6ccb2248ecb871336a3e66d8728d27b6647306130b1952d7f8086874a6adcb60

  • Size

    28KB

  • Sample

    221107-3kv9qahahq

  • MD5

    92d71db5d7ecf727f7387fbd2f033b2c

  • SHA1

    c6332ddff92d799cd3e70da87d97cc9f16af9077

  • SHA256

    6ccb2248ecb871336a3e66d8728d27b6647306130b1952d7f8086874a6adcb60

  • SHA512

    ecf55a956f0b7522e9952c2d3819fcb83ac8890a04cb654881ad411f70aa806cd8cb8b78820a8a293aa38a8f73b20f8910a073290d173fe1532b88c725c13036

  • SSDEEP

    768:mPRjlBNB+BFBoBsB4BTBmBAC86oLjEMcaNoNl9/NOIj:chF/CF/5

Score
10/10
gh0stratjokerbootkitdiscoveryevasioninfostealerpersistencerattrojan

Malware Config

Targets

    • Target

      6ccb2248ecb871336a3e66d8728d27b6647306130b1952d7f8086874a6adcb60

    • Size

      28KB

    • MD5

      92d71db5d7ecf727f7387fbd2f033b2c

    • SHA1

      c6332ddff92d799cd3e70da87d97cc9f16af9077

    • SHA256

      6ccb2248ecb871336a3e66d8728d27b6647306130b1952d7f8086874a6adcb60

    • SHA512

      ecf55a956f0b7522e9952c2d3819fcb83ac8890a04cb654881ad411f70aa806cd8cb8b78820a8a293aa38a8f73b20f8910a073290d173fe1532b88c725c13036

    • SSDEEP

      768:mPRjlBNB+BFBoBsB4BTBmBAC86oLjEMcaNoNl9/NOIj:chF/CF/5

    Score
    10/10
    gh0stratjokerbootkitdiscoveryevasioninfostealerpersistencerattrojan

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • UAC bypass

      evasiontrojan

    • joker

      Joker is an Android malware that targets billing and SMS fraud.

      infostealertrojanjoker

    • Creates new service(s)

      persistence

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks