gh0strat | 9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918a | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

9b2b624712...8a.exe

windows7-x64

9b2b624712...8a.exe

windows10-2004-x64

Sharing

General

Target

9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918a
Size

381KB
Sample

221127-1q6xasbe64
MD5

a1b285b63059ceff8e321204d74108fe
SHA1

ec6a41015e5f867a72b87e507cf15e4536bde9b5
SHA256

9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918a
SHA512

2eda9dbd8ba42d34e6c69f86e26746de01608e66e4f1e9cd61d512f8a70b234d502c3e06a93afc30a875e7f811160f95fe71647929cb7d964dbacb51cea03ae4
SSDEEP

6144:sQWCHwoQsITVYqmG3ZdPSumGermxwcmHi3ETJVYlDebGQuS:sQ5Hwo8TDhJdPSumGKBXuYGK

Score

10^/10

gh0strat ramnit banker evasion rat spyware stealer trojan upx worm

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918a.exe

Resource

win7-20221111-en

gh0strat ramnit banker rat spyware stealer trojan upx worm

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918a.exe

Resource

win10v2004-20220812-en

gh0strat ramnit banker evasion rat spyware stealer trojan upx worm

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918a
- Size
  
  381KB
- MD5
  
  a1b285b63059ceff8e321204d74108fe
- SHA1
  
  ec6a41015e5f867a72b87e507cf15e4536bde9b5
- SHA256
  
  9b2b6247120ce84a41583b731b3403ab4ef08cb9617ea42862e678f3d8bd918a
- SHA512
  
  2eda9dbd8ba42d34e6c69f86e26746de01608e66e4f1e9cd61d512f8a70b234d502c3e06a93afc30a875e7f811160f95fe71647929cb7d964dbacb51cea03ae4
- SSDEEP
  
  6144:sQWCHwoQsITVYqmG3ZdPSumGermxwcmHi3ETJVYlDebGQuS:sQ5Hwo8TDhJdPSumGKBXuYGK
Score

10^/10

gh0strat ramnit banker rat spyware stealer trojan upx worm evasion
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratramnitbankerratspywarestealertrojanupxworm

behavioral2

gh0stratramnitbankerevasionratspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy