Overview

overview

10

Static

static

10

3d40283945...d7.exe

windows7-x64

10

3d40283945...d7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d402839456c78e631107386c3822aeacbe87b296862ea88002b0ccd7d04b4d7

  • Size

    196KB

  • Sample

    221127-m5nglsca87

  • MD5

    a61d36651cd6705f3037a2a2568b5757

  • SHA1

    d63d20c75cdcdcba7b86affb487234437a11889d

  • SHA256

    3d402839456c78e631107386c3822aeacbe87b296862ea88002b0ccd7d04b4d7

  • SHA512

    9cc66c0564614e4fec6e3e74425f30d1f50df3c77bb92514f062626b39029631c99a6926c603df7575404cd4da59c66d66999832e1f71f49ea68188096f4dac1

  • SSDEEP

    6144:6sIt6nW8QOBTyPRqyhYPbHcTBlhHr1ndnkv0:39W8CJq8YPbHcT3U

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      3d402839456c78e631107386c3822aeacbe87b296862ea88002b0ccd7d04b4d7

    • Size

      196KB

    • MD5

      a61d36651cd6705f3037a2a2568b5757

    • SHA1

      d63d20c75cdcdcba7b86affb487234437a11889d

    • SHA256

      3d402839456c78e631107386c3822aeacbe87b296862ea88002b0ccd7d04b4d7

    • SHA512

      9cc66c0564614e4fec6e3e74425f30d1f50df3c77bb92514f062626b39029631c99a6926c603df7575404cd4da59c66d66999832e1f71f49ea68188096f4dac1

    • SSDEEP

      6144:6sIt6nW8QOBTyPRqyhYPbHcTBlhHr1ndnkv0:39W8CJq8YPbHcT3U

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks