Overview

overview

10

Static

static

10

d240bcbdf2...db.exe

windows7-x64

10

d240bcbdf2...db.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d240bcbdf2cb0e6403e8e7174a44caa7eed30149501f0eafa54b50053bc36adb

  • Size

    64KB

  • Sample

    221125-3cacaahc2x

  • MD5

    89bdb2056fcae054a269da7aca154faa

  • SHA1

    16dce1596c755a80ab95ea216dc90ab2c7e048bf

  • SHA256

    d240bcbdf2cb0e6403e8e7174a44caa7eed30149501f0eafa54b50053bc36adb

  • SHA512

    4676a9e1c82d7535791e8d2f74f4e3fab1b0fea3e48509ff38c19174bd7427cc73f69cc7c15db22049e71e53ec42984b50828685897730c1790efe39611de41c

  • SSDEEP

    1536:R5C0XQb625rDnqNht/9Qv1ZmrkYSO2rK/N3:fCCkHnw1O1WkjOqQ3

Score
10/10
gh0stratpersistenceratupx

Malware Config

Targets

    • Target

      d240bcbdf2cb0e6403e8e7174a44caa7eed30149501f0eafa54b50053bc36adb

    • Size

      64KB

    • MD5

      89bdb2056fcae054a269da7aca154faa

    • SHA1

      16dce1596c755a80ab95ea216dc90ab2c7e048bf

    • SHA256

      d240bcbdf2cb0e6403e8e7174a44caa7eed30149501f0eafa54b50053bc36adb

    • SHA512

      4676a9e1c82d7535791e8d2f74f4e3fab1b0fea3e48509ff38c19174bd7427cc73f69cc7c15db22049e71e53ec42984b50828685897730c1790efe39611de41c

    • SSDEEP

      1536:R5C0XQb625rDnqNht/9Qv1ZmrkYSO2rK/N3:fCCkHnw1O1WkjOqQ3

    Score
    10/10
    gh0stratpersistenceratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks