Overview

overview

10

Static

static

6d0c71d8e1...56.exe

windows7-x64

10

6d0c71d8e1...56.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d0c71d8e10e4d12d62fc61d2d9efa7daedbe3796fd0662823b2f5f58dda6856

  • Size

    156KB

  • Sample

    221128-gxc31sbd86

  • MD5

    7bd70a8884b79f8b34ca3b401312ffd0

  • SHA1

    ac9ec99192fbfdc904cf16902bfef106c822217d

  • SHA256

    6d0c71d8e10e4d12d62fc61d2d9efa7daedbe3796fd0662823b2f5f58dda6856

  • SHA512

    cc78dce87bd1b0413e2b965a81264cd7b848ee006fe6010680d0445e13a1b9791c35391bcb0abd32b2df852313d837e4a23e59d88148f6a05f5aa7add58f3465

  • SSDEEP

    3072:PO+JlkeHRQFxJZWg/Dnq0iurbi6ZYYWYR5UtJ+c+aie:XlkeHR4ZVDPxVFWq5Ur+c+9e

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      6d0c71d8e10e4d12d62fc61d2d9efa7daedbe3796fd0662823b2f5f58dda6856

    • Size

      156KB

    • MD5

      7bd70a8884b79f8b34ca3b401312ffd0

    • SHA1

      ac9ec99192fbfdc904cf16902bfef106c822217d

    • SHA256

      6d0c71d8e10e4d12d62fc61d2d9efa7daedbe3796fd0662823b2f5f58dda6856

    • SHA512

      cc78dce87bd1b0413e2b965a81264cd7b848ee006fe6010680d0445e13a1b9791c35391bcb0abd32b2df852313d837e4a23e59d88148f6a05f5aa7add58f3465

    • SSDEEP

      3072:PO+JlkeHRQFxJZWg/Dnq0iurbi6ZYYWYR5UtJ+c+aie:XlkeHR4ZVDPxVFWq5Ur+c+9e

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks