General
-
Target
15446a36122414565ffd62c5e90b86335c3911c6abf4d7098b81fa6f1311853b
-
Size
151KB
-
Sample
221127-lr2xeaca81
-
MD5
39493efb6e5d4c585aa653ac4725bf45
-
SHA1
32fb37c94f8180523c436688ce6e295128cb7174
-
SHA256
15446a36122414565ffd62c5e90b86335c3911c6abf4d7098b81fa6f1311853b
-
SHA512
f5bb24c9775d2a5df68b8a41b5d06d5fdc7c09f34647b464b7967ffbc20a28816ba6590e721658080b2f0095cba0bea43d01686b43941e3181ba928715a9d5ec
-
SSDEEP
3072:8Lk395hYXJ0o14riMEj5aGsiWBMdgjSUxWoKdLmIu5cnwH/fXGJZVvHtQn1yuRES:8QqKo14riMEj5aGsiWBMdgjSlZLm2Q/H
Static task
static1
Behavioral task
behavioral1
Sample
15446a36122414565ffd62c5e90b86335c3911c6abf4d7098b81fa6f1311853b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
15446a36122414565ffd62c5e90b86335c3911c6abf4d7098b81fa6f1311853b.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
15446a36122414565ffd62c5e90b86335c3911c6abf4d7098b81fa6f1311853b
-
Size
151KB
-
MD5
39493efb6e5d4c585aa653ac4725bf45
-
SHA1
32fb37c94f8180523c436688ce6e295128cb7174
-
SHA256
15446a36122414565ffd62c5e90b86335c3911c6abf4d7098b81fa6f1311853b
-
SHA512
f5bb24c9775d2a5df68b8a41b5d06d5fdc7c09f34647b464b7967ffbc20a28816ba6590e721658080b2f0095cba0bea43d01686b43941e3181ba928715a9d5ec
-
SSDEEP
3072:8Lk395hYXJ0o14riMEj5aGsiWBMdgjSUxWoKdLmIu5cnwH/fXGJZVvHtQn1yuRES:8QqKo14riMEj5aGsiWBMdgjSlZLm2Q/H
Score10/10-
Gh0st RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-