Overview

overview

10

Static

static

cecff1455e...8e.exe

windows7-x64

8

cecff1455e...8e.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cecff1455e72f9ec15a688273fffdfb1e2f1518bab6620d9ca53bdea925d7b8e

  • Size

    196KB

  • Sample

    221124-mgtzgsbd5y

  • MD5

    22ab39c1becc5c718ecf3f89f05b0f0a

  • SHA1

    ea651d7cc2d750e7039f52a2bc1277bf2ace4ac9

  • SHA256

    cecff1455e72f9ec15a688273fffdfb1e2f1518bab6620d9ca53bdea925d7b8e

  • SHA512

    5cdfa38286e427db2468099b381c170e2b8ac80eea39c36f86361cf1831c1783fdb7df14e4b211ef9bfcd52bc155d31962dc59f26a343a3e4583bcd752392607

  • SSDEEP

    3072:Vgmn0avOvtYz4nqSioDXx4uE9w2qbMUeZPgrQ/O/46Z4M15m:+w0avOvtYSiod4uYzqAvZd/246fvm

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      cecff1455e72f9ec15a688273fffdfb1e2f1518bab6620d9ca53bdea925d7b8e

    • Size

      196KB

    • MD5

      22ab39c1becc5c718ecf3f89f05b0f0a

    • SHA1

      ea651d7cc2d750e7039f52a2bc1277bf2ace4ac9

    • SHA256

      cecff1455e72f9ec15a688273fffdfb1e2f1518bab6620d9ca53bdea925d7b8e

    • SHA512

      5cdfa38286e427db2468099b381c170e2b8ac80eea39c36f86361cf1831c1783fdb7df14e4b211ef9bfcd52bc155d31962dc59f26a343a3e4583bcd752392607

    • SSDEEP

      3072:Vgmn0avOvtYz4nqSioDXx4uE9w2qbMUeZPgrQ/O/46Z4M15m:+w0avOvtYSiod4uYzqAvZd/246fvm

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks