Overview

overview

10

Static

static

10

5df6915069...88.exe

windows7-x64

10

5df6915069...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5df69150695e65249e8c569519484d3895be3d2f9c4ef5e1505653aec95c1488

  • Size

    377KB

  • Sample

    221127-mbcg9add9z

  • MD5

    e2d3519cfbf3135957cf1be7d3d2a62c

  • SHA1

    62ddba4887767c38d0b6230479f7652adf3314a3

  • SHA256

    5df69150695e65249e8c569519484d3895be3d2f9c4ef5e1505653aec95c1488

  • SHA512

    751e614aa2aa7b75313c878050811af80871636f0b06e1f458d111e28ab46f57ebac66f4e73930abdbc951c617cf6943e96d3fafc11864f7cabd940fd480c00f

  • SSDEEP

    6144:xsItKnWUQRBTyPRqyhYPbncTBlhHrDndnkv0oXZAr+xK6MD5ak6Poqg59G9Hi:OtWUjJq8YPbncT3C0axKt5RYGcC

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      5df69150695e65249e8c569519484d3895be3d2f9c4ef5e1505653aec95c1488

    • Size

      377KB

    • MD5

      e2d3519cfbf3135957cf1be7d3d2a62c

    • SHA1

      62ddba4887767c38d0b6230479f7652adf3314a3

    • SHA256

      5df69150695e65249e8c569519484d3895be3d2f9c4ef5e1505653aec95c1488

    • SHA512

      751e614aa2aa7b75313c878050811af80871636f0b06e1f458d111e28ab46f57ebac66f4e73930abdbc951c617cf6943e96d3fafc11864f7cabd940fd480c00f

    • SSDEEP

      6144:xsItKnWUQRBTyPRqyhYPbncTBlhHrDndnkv0oXZAr+xK6MD5ak6Poqg59G9Hi:OtWUjJq8YPbncT3C0axKt5RYGcC

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks