General
-
Target
d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474
-
Size
156KB
-
Sample
221128-gew36sec7z
-
MD5
3b167ad87eae016771c79d323622c84a
-
SHA1
6d882793461f4692bed40a902b75b302bd090106
-
SHA256
d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474
-
SHA512
833a8ae0e8a19a7c2ad06c71beea0c9e9dbbe0a5da2732b1c8515749eb7879c4880689596cb6f73fe78000c3a1d29421586fc148a464a655dd8d080a276224a9
-
SSDEEP
3072:PO+JlkeHRQFxJZWg/Dnq0iurbi6ZYYWYR5UtJ+c+aia:XlkeHR4ZVDPxVFWq5Ur+c+9a
Static task
static1
Behavioral task
behavioral1
Sample
d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474
-
Size
156KB
-
MD5
3b167ad87eae016771c79d323622c84a
-
SHA1
6d882793461f4692bed40a902b75b302bd090106
-
SHA256
d533791983d8f51eff0567cf66b471e9e69bd9b5096a84287260bd21ace9f474
-
SHA512
833a8ae0e8a19a7c2ad06c71beea0c9e9dbbe0a5da2732b1c8515749eb7879c4880689596cb6f73fe78000c3a1d29421586fc148a464a655dd8d080a276224a9
-
SSDEEP
3072:PO+JlkeHRQFxJZWg/Dnq0iurbi6ZYYWYR5UtJ+c+aia:XlkeHR4ZVDPxVFWq5Ur+c+9a
Score10/10-
Gh0st RAT payload
-
Blocklisted process makes network request
-
Sets DLL path for service in the registry
-
Sets file execution options in registry
-
Deletes itself
-
Loads dropped DLL
-
Drops file in System32 directory
-