Overview

overview

10

Static

static

f1f4b6a80d...4d.exe

windows7-x64

10

f1f4b6a80d...4d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f1f4b6a80d68988db5bc5a7b31a9512848f8aca9cb2fe72721491345af085f4d

  • Size

    14.9MB

  • Sample

    221126-ge3wqafb23

  • MD5

    90aaaf0c696b05986c771cebc158ce43

  • SHA1

    1d92041cdeff460d682220883b42a41970c45c62

  • SHA256

    f1f4b6a80d68988db5bc5a7b31a9512848f8aca9cb2fe72721491345af085f4d

  • SHA512

    fce47816a479d020e215841853dc71080344ef00fd76c7b7a38a93c241df6cfb58c7176016c2b98afd06a0b4d1f15cc939dd8ea58357583e1c0fe7c102ce18c0

  • SSDEEP

    393216:TgGJjm1ji73pN93/6fVuN/pkdMX1fA0A0djA+9YvkFw+eNNYl:UYK1m73pv6tYvAJ++vQwLNE

Score
10/10
gh0stratdiscoveryexploitpersistencerat

Malware Config

Targets

    • Target

      f1f4b6a80d68988db5bc5a7b31a9512848f8aca9cb2fe72721491345af085f4d

    • Size

      14.9MB

    • MD5

      90aaaf0c696b05986c771cebc158ce43

    • SHA1

      1d92041cdeff460d682220883b42a41970c45c62

    • SHA256

      f1f4b6a80d68988db5bc5a7b31a9512848f8aca9cb2fe72721491345af085f4d

    • SHA512

      fce47816a479d020e215841853dc71080344ef00fd76c7b7a38a93c241df6cfb58c7176016c2b98afd06a0b4d1f15cc939dd8ea58357583e1c0fe7c102ce18c0

    • SSDEEP

      393216:TgGJjm1ji73pN93/6fVuN/pkdMX1fA0A0djA+9YvkFw+eNNYl:UYK1m73pv6tYvAJ++vQwLNE

    Score
    10/10
    gh0stratdiscoveryexploitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks