Overview

overview

10

Static

static

ebd2f0eda7...fe.exe

windows7-x64

1

ebd2f0eda7...fe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ebd2f0eda75704d4c27a2f55efee16d00b8512cffddee4c3f7c8f6bf5a19d0fe

  • Size

    94KB

  • Sample

    221123-p1jc7scg24

  • MD5

    85a6c16d6ec612b431d71435dd753580

  • SHA1

    7590f2ef4a077926d71336e623a80dc00fa3d014

  • SHA256

    ebd2f0eda75704d4c27a2f55efee16d00b8512cffddee4c3f7c8f6bf5a19d0fe

  • SHA512

    cd29404afc5f980f2af2d591195f9154515404ba5646a3990442a34bfc5e2aca9a417a98069b34c4b0f6b99a033b62f8837591b8d913f33277ceb2839aac7aec

  • SSDEEP

    1536:BFQwQsiEoa2BhmUB4I+yuDg1uUO2mntP2qZNKHuNMaSJETxmIGykRZhcMePmrOa:BFQwQhEOLfuDg0PtOqzKONqsEykRLSeP

Score
10/10
gh0stratpersistenceratupx

Malware Config

Targets

    • Target

      ebd2f0eda75704d4c27a2f55efee16d00b8512cffddee4c3f7c8f6bf5a19d0fe

    • Size

      94KB

    • MD5

      85a6c16d6ec612b431d71435dd753580

    • SHA1

      7590f2ef4a077926d71336e623a80dc00fa3d014

    • SHA256

      ebd2f0eda75704d4c27a2f55efee16d00b8512cffddee4c3f7c8f6bf5a19d0fe

    • SHA512

      cd29404afc5f980f2af2d591195f9154515404ba5646a3990442a34bfc5e2aca9a417a98069b34c4b0f6b99a033b62f8837591b8d913f33277ceb2839aac7aec

    • SSDEEP

      1536:BFQwQsiEoa2BhmUB4I+yuDg1uUO2mntP2qZNKHuNMaSJETxmIGykRZhcMePmrOa:BFQwQhEOLfuDg0PtOqzKONqsEykRLSeP

    Score
    10/10
    gh0stratpersistenceratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks