gh0strat | f88c3ae3c180a4cda806e9775db25a49d197de3c511dd986ade5b2421b3b77ad | Triage

Submit
Reports

Overview

overview

Static

static

f88c3ae3c1...ad.exe

windows7-x64

f88c3ae3c1...ad.exe

windows10-2004-x64

Sharing

General

Target

f88c3ae3c180a4cda806e9775db25a49d197de3c511dd986ade5b2421b3b77ad
Size

49KB
Sample

221201-q8381she2t
MD5

127ebfdbfb8273a02eab034501afe723
SHA1

8e9915e522abb736d78510d041b9957d1e7c672d
SHA256

f88c3ae3c180a4cda806e9775db25a49d197de3c511dd986ade5b2421b3b77ad
SHA512

785c08be8b82abd905865395cf13842aaaa1f1a0a3228969058b4e00e6005cdd126705dfd2eec831142eaaeb4717b73d66e92d63f234da7e1d8a344a5fafa6f2
SSDEEP

768:BS2oDQTIN8sPN7BhZYSwFnDkHtx5zgtgoEbZj4wL+tueUuJGdJ5827GI4TFXE:42ocSPj+IyON1L+tueS7GIaFXE

Score

10^/10

gh0strat persistence rat

Static task

static1

Behavioral task

behavioral1

Sample

f88c3ae3c180a4cda806e9775db25a49d197de3c511dd986ade5b2421b3b77ad.exe

Resource

win7-20220812-en

gh0strat persistence rat

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

f88c3ae3c180a4cda806e9775db25a49d197de3c511dd986ade5b2421b3b77ad.exe

Resource

win10v2004-20220812-en

gh0strat persistence rat

windows10-2004-x64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  f88c3ae3c180a4cda806e9775db25a49d197de3c511dd986ade5b2421b3b77ad
- Size
  
  49KB
- MD5
  
  127ebfdbfb8273a02eab034501afe723
- SHA1
  
  8e9915e522abb736d78510d041b9957d1e7c672d
- SHA256
  
  f88c3ae3c180a4cda806e9775db25a49d197de3c511dd986ade5b2421b3b77ad
- SHA512
  
  785c08be8b82abd905865395cf13842aaaa1f1a0a3228969058b4e00e6005cdd126705dfd2eec831142eaaeb4717b73d66e92d63f234da7e1d8a344a5fafa6f2
- SSDEEP
  
  768:BS2oDQTIN8sPN7BhZYSwFnDkHtx5zgtgoEbZj4wL+tueUuJGdJ5827GI4TFXE:42ocSPj+IyON1L+tueS7GIaFXE
Score

10^/10

gh0strat persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Drops file in Drivers directory
- Sets DLL path for service in the registry
  persistence
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratpersistencerat

behavioral2

gh0stratpersistencerat

© 2018-2025

Terms | Privacy