Overview

overview

10

Static

static

9c2961ddfe...d0.exe

windows7-x64

9

9c2961ddfe...d0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9c2961ddfe9e57c29d84d211f7f66a7d3a050b7a486b4dafb3dc28a7945b32d0

  • Size

    1.4MB

  • Sample

    221123-qtv9vseh29

  • MD5

    065cc766a845f2e8f089e4c9ccd3faa9

  • SHA1

    3217b6f0c1c29eb9fd642d13f43d4674cb18da39

  • SHA256

    9c2961ddfe9e57c29d84d211f7f66a7d3a050b7a486b4dafb3dc28a7945b32d0

  • SHA512

    56097b0a78de48dd470402ab3cc5d92aa07575e47e6f32932ebcb52fe277d5d2e3607ff6efecd62f93dd05cd0c6b32d62dca54ca2f8f42cfa31d6e075853b7f6

  • SSDEEP

    24576:BtI5N9pcdBzPDMQhYExks+KJ7Wyvy2BBGGSt6jTClt5T4W+E1j22O9WSeuyV9Fu1:bI5fej0QhYS+KBf3hY1ljLFMWSeuyV94

Score
10/10
gh0stratevasionrat

Malware Config

Targets

    • Target

      9c2961ddfe9e57c29d84d211f7f66a7d3a050b7a486b4dafb3dc28a7945b32d0

    • Size

      1.4MB

    • MD5

      065cc766a845f2e8f089e4c9ccd3faa9

    • SHA1

      3217b6f0c1c29eb9fd642d13f43d4674cb18da39

    • SHA256

      9c2961ddfe9e57c29d84d211f7f66a7d3a050b7a486b4dafb3dc28a7945b32d0

    • SHA512

      56097b0a78de48dd470402ab3cc5d92aa07575e47e6f32932ebcb52fe277d5d2e3607ff6efecd62f93dd05cd0c6b32d62dca54ca2f8f42cfa31d6e075853b7f6

    • SSDEEP

      24576:BtI5N9pcdBzPDMQhYExks+KJ7Wyvy2BBGGSt6jTClt5T4W+E1j22O9WSeuyV9Fu1:bI5fej0QhYS+KBf3hY1ljLFMWSeuyV94

    Score
    10/10
    evasiongh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks