Overview

overview

10

Static

static

1

1bfa758fb9...03.exe

windows7-x64

10

1bfa758fb9...03.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1bfa758fb9a4014462ee0182cb1e7c8866e03f9cbb40cec857fe3ef4e1cf0403

  • Size

    236KB

  • Sample

    221128-m7sjcadf4x

  • MD5

    3d80e6a989ea622e375699511f4d5dee

  • SHA1

    964cd3555cb021285fc003f1476b2025097a56e5

  • SHA256

    1bfa758fb9a4014462ee0182cb1e7c8866e03f9cbb40cec857fe3ef4e1cf0403

  • SHA512

    012c2eec7c84c6a0a90a02a2307a5a560e19502f10e73af1ffc82903282fdf0eb25d1b2959662095c9857ac778b214f8a8e54319160598e3c6ec49d26bcff98a

  • SSDEEP

    6144:dQqjB8lD9jRWWPSRf5lRuGMJnuDoVg5cXa54CtrINR0A:WlFR3Yf5l2uMVg5cXl6rBA

Score
10/10
gh0stratdiscoveryexploitrat

Malware Config

Targets

    • Target

      1bfa758fb9a4014462ee0182cb1e7c8866e03f9cbb40cec857fe3ef4e1cf0403

    • Size

      236KB

    • MD5

      3d80e6a989ea622e375699511f4d5dee

    • SHA1

      964cd3555cb021285fc003f1476b2025097a56e5

    • SHA256

      1bfa758fb9a4014462ee0182cb1e7c8866e03f9cbb40cec857fe3ef4e1cf0403

    • SHA512

      012c2eec7c84c6a0a90a02a2307a5a560e19502f10e73af1ffc82903282fdf0eb25d1b2959662095c9857ac778b214f8a8e54319160598e3c6ec49d26bcff98a

    • SSDEEP

      6144:dQqjB8lD9jRWWPSRf5lRuGMJnuDoVg5cXa54CtrINR0A:WlFR3Yf5l2uMVg5cXl6rBA

    Score
    10/10
    gh0stratdiscoveryexploitrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks