Overview

overview

10

Static

static

046fe48a30...7f.exe

windows7-x64

10

046fe48a30...7f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    046fe48a30c5bc1f216a050956223187164af9eac0d88858fa94e74f6ef8b57f

  • Size

    63KB

  • Sample

    221129-qs85bsfh3v

  • MD5

    f5513a736df6e28b746b6d4259779427

  • SHA1

    768b7c01b66a1e6078eb2c0d0a14361c42bdbd3a

  • SHA256

    046fe48a30c5bc1f216a050956223187164af9eac0d88858fa94e74f6ef8b57f

  • SHA512

    946c91ee673b86fdc8d88a1d69305a57b8c27fe324df453c68951e9b32e6a45cdfc21eefcc33f33c836249ef77788b26811f41e6a4330c3261e3e4b4288fbb7b

  • SSDEEP

    1536:p9H8QXFa87stKeGxS7q6dODuScslP26f3zNAvTU:LHtU7zWS7qXZluu3BAQ

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      046fe48a30c5bc1f216a050956223187164af9eac0d88858fa94e74f6ef8b57f

    • Size

      63KB

    • MD5

      f5513a736df6e28b746b6d4259779427

    • SHA1

      768b7c01b66a1e6078eb2c0d0a14361c42bdbd3a

    • SHA256

      046fe48a30c5bc1f216a050956223187164af9eac0d88858fa94e74f6ef8b57f

    • SHA512

      946c91ee673b86fdc8d88a1d69305a57b8c27fe324df453c68951e9b32e6a45cdfc21eefcc33f33c836249ef77788b26811f41e6a4330c3261e3e4b4288fbb7b

    • SSDEEP

      1536:p9H8QXFa87stKeGxS7q6dODuScslP26f3zNAvTU:LHtU7zWS7qXZluu3BAQ

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks