Overview

overview

10

Static

static

822f4d3551...cd.exe

windows7-x64

1

822f4d3551...cd.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    822f4d3551d9cefd1c22278b7a2fc08b93fe9dce0c97c7c36fcdb0dc384a42cd

  • Size

    94KB

  • Sample

    221129-hntvvafa49

  • MD5

    74a5c99c57508089e2896bc4745e24b7

  • SHA1

    157efdda60aa354f7aa6d24eff32852f5cd0656d

  • SHA256

    822f4d3551d9cefd1c22278b7a2fc08b93fe9dce0c97c7c36fcdb0dc384a42cd

  • SHA512

    e529c45747e95610888f29b2079d82718ca8fb1492c219d66de90d96b91be884b0500368417aee409400db46f0139e79c76c6cd8f729c9b3449cc402fe4f94ef

  • SSDEEP

    1536:9FQwQsiEoa2BhmUB4I+yuDg1uUO2mntP2qZNKHuNMaSJETxmIGykRZhcMePmrOa:9FQwQhEOLfuDg0PtOqzKONqsEykRLSeP

Score
10/10
gh0stratpersistenceratupx

Malware Config

Targets

    • Target

      822f4d3551d9cefd1c22278b7a2fc08b93fe9dce0c97c7c36fcdb0dc384a42cd

    • Size

      94KB

    • MD5

      74a5c99c57508089e2896bc4745e24b7

    • SHA1

      157efdda60aa354f7aa6d24eff32852f5cd0656d

    • SHA256

      822f4d3551d9cefd1c22278b7a2fc08b93fe9dce0c97c7c36fcdb0dc384a42cd

    • SHA512

      e529c45747e95610888f29b2079d82718ca8fb1492c219d66de90d96b91be884b0500368417aee409400db46f0139e79c76c6cd8f729c9b3449cc402fe4f94ef

    • SSDEEP

      1536:9FQwQsiEoa2BhmUB4I+yuDg1uUO2mntP2qZNKHuNMaSJETxmIGykRZhcMePmrOa:9FQwQhEOLfuDg0PtOqzKONqsEykRLSeP

    Score
    10/10
    gh0stratpersistenceratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks