Overview

overview

10

Static

static

10

53c4b7327c...12.exe

windows7-x64

10

53c4b7327c...12.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212

  • Size

    238KB

  • Sample

    221107-qavh8aggc6

  • MD5

    0a4af18509e97c59a365434368da74f4

  • SHA1

    d88c9247953bada73bff1f7c6c10b5dd8c53fcd4

  • SHA256

    53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212

  • SHA512

    bd8e58f728ff45b4f57954f119050fcfedbdfdc9457c93ca3ca75977590f705554a1bfab42512b0641b84d614309b7f3974dfe7850ea5bf771c17262f1f90da5

  • SSDEEP

    3072:s0V0g2XAc5eVcB9RdrRmY/+zzfgGWjpitlmlRVeJWSpU+EXXVTfQ8ulV:s1eVcB33miSz4B6lKVeJWHlXW8ul

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212

    • Size

      238KB

    • MD5

      0a4af18509e97c59a365434368da74f4

    • SHA1

      d88c9247953bada73bff1f7c6c10b5dd8c53fcd4

    • SHA256

      53c4b7327c5bb505017383a3bdf580208bf503c537f1618435b4f6f1b0362212

    • SHA512

      bd8e58f728ff45b4f57954f119050fcfedbdfdc9457c93ca3ca75977590f705554a1bfab42512b0641b84d614309b7f3974dfe7850ea5bf771c17262f1f90da5

    • SSDEEP

      3072:s0V0g2XAc5eVcB9RdrRmY/+zzfgGWjpitlmlRVeJWSpU+EXXVTfQ8ulV:s1eVcB33miSz4B6lKVeJWHlXW8ul

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Deletes itself

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks