Overview

overview

10

Static

static

10

9c2d61c306...8d.exe

windows7-x64

10

9c2d61c306...8d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    9c2d61c306e7c84e694d5ae7e369be861b3c59229a498ffe5651eb950ef0428d

  • Size

    531KB

  • Sample

    221107-bra4ksbcb9

  • MD5

    097bb8a0bc23b9af1c61a9f957b41830

  • SHA1

    1547c489227fd9db822f573d6f927b0c7f570d89

  • SHA256

    9c2d61c306e7c84e694d5ae7e369be861b3c59229a498ffe5651eb950ef0428d

  • SHA512

    31aed481a27b358a1032a14138cf470721bea2a8573d1accbdf7b6c7165cba3e7787a40be20dfcfc23d6f9bd1d699dfe4588eb57a7a5e7061a7e4cee6acaa9f0

  • SSDEEP

    12288:AM5HYC52oxL3aKHx5r+TuxPhNWwgsAO3otVtj:AM5HYC0w3aKHx5r+TuxPhpgpOmVtj

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      9c2d61c306e7c84e694d5ae7e369be861b3c59229a498ffe5651eb950ef0428d

    • Size

      531KB

    • MD5

      097bb8a0bc23b9af1c61a9f957b41830

    • SHA1

      1547c489227fd9db822f573d6f927b0c7f570d89

    • SHA256

      9c2d61c306e7c84e694d5ae7e369be861b3c59229a498ffe5651eb950ef0428d

    • SHA512

      31aed481a27b358a1032a14138cf470721bea2a8573d1accbdf7b6c7165cba3e7787a40be20dfcfc23d6f9bd1d699dfe4588eb57a7a5e7061a7e4cee6acaa9f0

    • SSDEEP

      12288:AM5HYC52oxL3aKHx5r+TuxPhNWwgsAO3otVtj:AM5HYC0w3aKHx5r+TuxPhpgpOmVtj

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks