runningrat | cb5892e66ce5c2e7b5ab9946e77e1e634fdc5588a729ad6fdaaa4fd822f27051

General

Target

cb5892e66ce5c2e7b5ab9946e77e1e634fdc5588a729ad6fdaaa4fd822f27051
Size

1.5MB
Sample

221126-wm4kjsgb71
MD5

fae9be3b3ea035816b3f8649f51bbf77
SHA1

baea3fae072e014881706ae7eee5bb766ef94374
SHA256

cb5892e66ce5c2e7b5ab9946e77e1e634fdc5588a729ad6fdaaa4fd822f27051
SHA512

43696b4169ddfe3ccff1a24d5850257cfd69b2c228af132649833d10c6a272e7030fa3fdab7a25d0890d92957f233cbe389c079d86c5fa2e3c825be5ed0ca69e
SSDEEP

24576:tSnO3Wvw9Ngolr0kycTrNlFCatJFhfHni0NCXsFh74C/D0cG6OZU1:tNWvwsoh0HqNlBt9lC8Fh74QD0KX1

Score

10^/10

runningrat persistence

Malware Config

Targets

- Target
  
  Gh0st.exe
- Size
  
  3.4MB
- MD5
  
  437df1d6ecc5605108f034562c586886
- SHA1
  
  50097209d3da34c406aac85d27253eaabe63e12f
- SHA256
  
  dcc2afb9ff8f4b8e4e96999e11d0fedcb2fe0f67ae3f341f4412c0d90f9ab027
- SHA512
  
  5a75d28762ccd193b08ab9d49755a8866ab94d265161deaaf30bf7d915595a7d34c95c76b6ca4a9d2654e0cf278b91367a879eaa5bf7fbd2b01cb71cee18f03e
- SSDEEP
  
  49152:1GTFbIo5ByEbssT/qyXkXVOVNFNzIfjYVha+s9Bxgwu:1wt50ABUXqFqjW4+QBGw
Score

1^/10
behavioral1 behavioral2
- Target
  
  Install.dat
- Size
  
  56KB
- MD5
  
  b35a79c7cfee27644c72c02f713f032a
- SHA1
  
  16258f41d5c08019a002a484284176f8ce44072c
- SHA256
  
  5216d2ca86242f768b204637536a1b3ad2f6c80af6cad5ef798e757667608ef1
- SHA512
  
  f235e663022818a561a4b368477f5384c72cb2deb48e43d5551dda8a1df888e5bc1413eb92c49a71967472b472a7bbaefd539477332449d127754840bc40e346
- SSDEEP
  
  768:QUuzp0fg4fyRR5tHC4kt5Jp9k0FBxTJp8jSE5+Nk/QBeLPJcukgb4a:zfFYrHzmJcABxt2mE5OAkYJdz4a
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
behavioral3 behavioral4
- Target
  
  server.exe
- Size
  
  56KB
- MD5
  
  f1df8c367943c17dfebdd15b127e33e7
- SHA1
  
  fe898d4f2cf5b793368a071e9f9590cd4cc4e2ef
- SHA256
  
  f9db82c372cf49d7adfeb19deb46a8f291cccd255acd7402d8bd8188eec85a18
- SHA512
  
  55ca309b55da46a1a27962d477524bc8cbdd929583b716725efa425ea775aba7f8a4c2c7a798c9a3897ee50bf183ceed8ee5a4c7288f16d361ef4926252535ef
- SSDEEP
  
  768:QUuzp0fg4fyRR5tHC4kt5Jp9k0FBxTJp8jSE5+Nk/QBeLPJbukgb4a:zfFYrHzmJcABxt2mE5OAkYJyz4a
Score

8^/10

persistence
- Executes dropped EXE
- Sets DLL path for service in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Creates a Windows Service
  persistence
- Drops file in System32 directory
behavioral5 behavioral6