Overview

overview

10

Static

static

8f82b61558...81.exe

windows7-x64

10

8f82b61558...81.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f82b6155825fe6b473dda89876a2c370b3203a29fa4879926b2ab1507600581

  • Size

    188KB

  • Sample

    221128-gpvm4aah35

  • MD5

    1c74cf66c3957ce373c6d33e9b508dd9

  • SHA1

    4a98cc989a7344a699a7d9538ef0bb1e5502fdd4

  • SHA256

    8f82b6155825fe6b473dda89876a2c370b3203a29fa4879926b2ab1507600581

  • SHA512

    dcd17c16d6ff86afec4c2ac3c3fe44e4e13906bc3aad65a48b9fda3803b711ecd17c76d4a9ce47ab33712af6da43ee3910c6142812a505bd50195369561b8412

  • SSDEEP

    3072:djS7hxjpOO0L8xOgv/q1FQt5YJTpZrlboOYhwyNKby:djS7FTKbQsJFB8

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      8f82b6155825fe6b473dda89876a2c370b3203a29fa4879926b2ab1507600581

    • Size

      188KB

    • MD5

      1c74cf66c3957ce373c6d33e9b508dd9

    • SHA1

      4a98cc989a7344a699a7d9538ef0bb1e5502fdd4

    • SHA256

      8f82b6155825fe6b473dda89876a2c370b3203a29fa4879926b2ab1507600581

    • SHA512

      dcd17c16d6ff86afec4c2ac3c3fe44e4e13906bc3aad65a48b9fda3803b711ecd17c76d4a9ce47ab33712af6da43ee3910c6142812a505bd50195369561b8412

    • SSDEEP

      3072:djS7hxjpOO0L8xOgv/q1FQt5YJTpZrlboOYhwyNKby:djS7FTKbQsJFB8

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks