Overview

overview

10

Static

static

8

84bb149505...3f.exe

windows7-x64

10

84bb149505...3f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    84bb149505d8d1b3a32527aac0dbdeeefeefdfe0d9830798057985484e3c713f

  • Size

    285KB

  • Sample

    221129-hdbaraha8t

  • MD5

    e571fff236c7bee77e157fc3fcb9d6ea

  • SHA1

    7d3fe018030a4b8d6cd95f113600615d29158e0b

  • SHA256

    84bb149505d8d1b3a32527aac0dbdeeefeefdfe0d9830798057985484e3c713f

  • SHA512

    ead3d54219efce992c871abf9169538c9d8ad69ba38d5142081f46d02cec64318b3749ea847013bd00f6d6ed2f4c0bdd469144d5b5b68e25fe6a278124963264

  • SSDEEP

    6144:If4ciXeyVT51buHjCgvXSOhSFi62Tgbny7a34cq3H3i34X04vnyNOwmjtG:xXWmgvXJgFid5XSIN/yNmxG

Score
10/10
gh0stratpersistenceratvmprotect

Malware Config

Targets

    • Target

      84bb149505d8d1b3a32527aac0dbdeeefeefdfe0d9830798057985484e3c713f

    • Size

      285KB

    • MD5

      e571fff236c7bee77e157fc3fcb9d6ea

    • SHA1

      7d3fe018030a4b8d6cd95f113600615d29158e0b

    • SHA256

      84bb149505d8d1b3a32527aac0dbdeeefeefdfe0d9830798057985484e3c713f

    • SHA512

      ead3d54219efce992c871abf9169538c9d8ad69ba38d5142081f46d02cec64318b3749ea847013bd00f6d6ed2f4c0bdd469144d5b5b68e25fe6a278124963264

    • SSDEEP

      6144:If4ciXeyVT51buHjCgvXSOhSFi62Tgbny7a34cq3H3i34X04vnyNOwmjtG:xXWmgvXJgFid5XSIN/yNmxG

    Score
    10/10
    gh0stratpersistenceratvmprotect

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks