gh0strat | a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a | Triage

Submit
Reports

Overview

overview

Static

static

a12ad61598...8a.exe

windows7-x64

a12ad61598...8a.exe

windows10-2004-x64

Sharing

General

Target

a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a
Size

204KB
Sample

221129-ey1vcshc9t
MD5

0605b275f82fca535c7b2296d19c9ca0
SHA1

3d30333cba7aae765e37a0704b4f9bb7f309c063
SHA256

a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a
SHA512

3632a6b8f7fe0f626a583b0546df25f36b2082770c63e7e2205cda9ab058e06b52125100a15d7fdff329f98848b341f15f1949b52665bf3bbe81cac6f9496dd6
SSDEEP

6144:WG5/yQ1/h46Fl0E76QQNUTBl2pqPK1Rpa:WcyuhRFN76ZUT3kxvY

Score

10^/10

gh0strat persistence rat

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a.exe

Resource

win7-20220812-en

gh0strat persistence rat

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a.exe

Resource

win10v2004-20220812-en

gh0strat persistence rat

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a
- Size
  
  204KB
- MD5
  
  0605b275f82fca535c7b2296d19c9ca0
- SHA1
  
  3d30333cba7aae765e37a0704b4f9bb7f309c063
- SHA256
  
  a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a
- SHA512
  
  3632a6b8f7fe0f626a583b0546df25f36b2082770c63e7e2205cda9ab058e06b52125100a15d7fdff329f98848b341f15f1949b52665bf3bbe81cac6f9496dd6
- SSDEEP
  
  6144:WG5/yQ1/h46Fl0E76QQNUTBl2pqPK1Rpa:WcyuhRFN76ZUT3kxvY
Score

10^/10

gh0strat persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Sets DLL path for service in the registry
  persistence
- Deletes itself
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratpersistencerat

behavioral2

gh0stratpersistencerat

© 2018-2025

Terms | Privacy