Overview

overview

10

Static

static

ff044ed448...ee.exe

windows7-x64

10

ff044ed448...ee.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ff044ed44831835e0c5cdf829edbd2e151946c656810e44fe4ef525e9c1e22ee

  • Size

    183KB

  • Sample

    221107-tnstbsfch7

  • MD5

    06b381027306aeb0dbf6b4e92d5a1079

  • SHA1

    52b948c0bb36011da29d77617ec36dc718f93ee0

  • SHA256

    ff044ed44831835e0c5cdf829edbd2e151946c656810e44fe4ef525e9c1e22ee

  • SHA512

    e1865f1eb28accf93dbada5bfe94a77c6061c5efb3caef33f4b8dd8a0cb75f8cfe9fe6a9d290a89f23d40cd9471feac2b03ba67260b0d3b3661c861b0cb5d3b3

  • SSDEEP

    3072:nltrDTti5zBW7HE2f2DZnvokxVXHp0LCDdoWD4Jergh7M6WKU:lJUxBW7HEvDZvo8XHOCDdoWHgjWH

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      ff044ed44831835e0c5cdf829edbd2e151946c656810e44fe4ef525e9c1e22ee

    • Size

      183KB

    • MD5

      06b381027306aeb0dbf6b4e92d5a1079

    • SHA1

      52b948c0bb36011da29d77617ec36dc718f93ee0

    • SHA256

      ff044ed44831835e0c5cdf829edbd2e151946c656810e44fe4ef525e9c1e22ee

    • SHA512

      e1865f1eb28accf93dbada5bfe94a77c6061c5efb3caef33f4b8dd8a0cb75f8cfe9fe6a9d290a89f23d40cd9471feac2b03ba67260b0d3b3661c861b0cb5d3b3

    • SSDEEP

      3072:nltrDTti5zBW7HE2f2DZnvokxVXHp0LCDdoWD4Jergh7M6WKU:lJUxBW7HEvDZvo8XHOCDdoWHgjWH

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks