Overview

overview

10

Static

static

088d5370e2...6c.exe

windows7-x64

10

088d5370e2...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    088d5370e2d8e137918e999486c5bab705a4ddb74bb2e80143ad7b16133b2a6c

  • Size

    176KB

  • Sample

    221128-hazh6sce29

  • MD5

    19f541f0d9e1707caca4dc4c2b122826

  • SHA1

    c319a4b34e699537c7a26a59822ddfb0a10c1a62

  • SHA256

    088d5370e2d8e137918e999486c5bab705a4ddb74bb2e80143ad7b16133b2a6c

  • SHA512

    2cddc7e2c2a998bb565af2d31da0ec50a89075aa60b8f56a3c348916d21d512431c046a016c76edb1cfea13d27d1bb4f187119477d5361d1cc6d6452a9971b45

  • SSDEEP

    3072:siiUS/vlXvl/HfG/dOlWRkNpZHPImtS5Es2K9Tbw9yDxJ:CUS3f/HfGYlsk7BPXS5Es2ATbwi3

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      088d5370e2d8e137918e999486c5bab705a4ddb74bb2e80143ad7b16133b2a6c

    • Size

      176KB

    • MD5

      19f541f0d9e1707caca4dc4c2b122826

    • SHA1

      c319a4b34e699537c7a26a59822ddfb0a10c1a62

    • SHA256

      088d5370e2d8e137918e999486c5bab705a4ddb74bb2e80143ad7b16133b2a6c

    • SHA512

      2cddc7e2c2a998bb565af2d31da0ec50a89075aa60b8f56a3c348916d21d512431c046a016c76edb1cfea13d27d1bb4f187119477d5361d1cc6d6452a9971b45

    • SSDEEP

      3072:siiUS/vlXvl/HfG/dOlWRkNpZHPImtS5Es2K9Tbw9yDxJ:CUS3f/HfGYlsk7BPXS5Es2ATbwi3

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks