Overview

overview

10

Static

static

83577558b7...84.exe

windows7-x64

10

83577558b7...84.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    83577558b712f4a3a6b0023bb2f656ed1ecb652deea54c82a6c1c406412e6284

  • Size

    177KB

  • Sample

    221124-2ydq6ahe61

  • MD5

    7562f2208fca8e51df007312cbc00ab1

  • SHA1

    cfe1c6dba599820e1c3f9b55de1d52c3b6af68c7

  • SHA256

    83577558b712f4a3a6b0023bb2f656ed1ecb652deea54c82a6c1c406412e6284

  • SHA512

    0f3308776b4fb70e40bc52d2e429d7eb7fc944694c0d8194364ff4bf596bac6ef733854c6050d4400df0f732723ab461f64c0ba9836240acba069aa8a005c543

  • SSDEEP

    3072:ezZCwyESXpbo6aywuxuWuHZQEIplVwE7T2f46S7O+FI7aICssX:cyLs6ayFus7j7X

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      83577558b712f4a3a6b0023bb2f656ed1ecb652deea54c82a6c1c406412e6284

    • Size

      177KB

    • MD5

      7562f2208fca8e51df007312cbc00ab1

    • SHA1

      cfe1c6dba599820e1c3f9b55de1d52c3b6af68c7

    • SHA256

      83577558b712f4a3a6b0023bb2f656ed1ecb652deea54c82a6c1c406412e6284

    • SHA512

      0f3308776b4fb70e40bc52d2e429d7eb7fc944694c0d8194364ff4bf596bac6ef733854c6050d4400df0f732723ab461f64c0ba9836240acba069aa8a005c543

    • SSDEEP

      3072:ezZCwyESXpbo6aywuxuWuHZQEIplVwE7T2f46S7O+FI7aICssX:cyLs6ayFus7j7X

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks