gh0strat | 46917a5c8871af92a3917f6b88633adf614d984320fcc4aaf58d770663a73963 | Triage

Submit
Reports

Overview

overview

Static

static

46917a5c88...63.exe

windows7-x64

46917a5c88...63.exe

windows10-2004-x64

3

Sharing

General

Target

46917a5c8871af92a3917f6b88633adf614d984320fcc4aaf58d770663a73963
Size

84KB
Sample

221123-vwrfxadb2w
MD5

66e81172aa35027272d485d88572fb52
SHA1

695400a84b121c6f3992a8b86b83a2ab937d458d
SHA256

46917a5c8871af92a3917f6b88633adf614d984320fcc4aaf58d770663a73963
SHA512

e1f8dc4339c29d7482f8d3225249a8bc5ec3df1b1bd26810ea2f883771f311debf812a0aee150735963425f34e745ad822e446627cebc392b578b37e4e376a63
SSDEEP

1536:bA1owTzFlX9GATczpfg3gnDlnp9YqvCZdBrCo3swUsUwIzLCv:E17Tzr9GCczp43gDhp9Y/eolUw+LC

Score

10^/10

gh0strat persistence rat

Static task

static1

Behavioral task

behavioral1

Sample

46917a5c8871af92a3917f6b88633adf614d984320fcc4aaf58d770663a73963.exe

Resource

win7-20220901-en

gh0strat persistence rat

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

46917a5c8871af92a3917f6b88633adf614d984320fcc4aaf58d770663a73963.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  46917a5c8871af92a3917f6b88633adf614d984320fcc4aaf58d770663a73963
- Size
  
  84KB
- MD5
  
  66e81172aa35027272d485d88572fb52
- SHA1
  
  695400a84b121c6f3992a8b86b83a2ab937d458d
- SHA256
  
  46917a5c8871af92a3917f6b88633adf614d984320fcc4aaf58d770663a73963
- SHA512
  
  e1f8dc4339c29d7482f8d3225249a8bc5ec3df1b1bd26810ea2f883771f311debf812a0aee150735963425f34e745ad822e446627cebc392b578b37e4e376a63
- SSDEEP
  
  1536:bA1owTzFlX9GATczpfg3gnDlnp9YqvCZdBrCo3swUsUwIzLCv:E17Tzr9GCczp43gDhp9Y/eolUw+LC
Score

10^/10

gh0strat persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratpersistencerat

behavioral2

© 2018-2024

Terms | Privacy