Overview

overview

10

Static

static

10

2449bdedf6...0e.exe

windows7-x64

10

2449bdedf6...0e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2449bdedf691972e43f4ea34bc6aa905be406196e73c82bf248738acadf4240e

  • Size

    204KB

  • Sample

    221203-fcntcaeh65

  • MD5

    9232c3a331afee1078a218943b581c16

  • SHA1

    169c4c5da07f7de97dac52b129bddd5608ff402b

  • SHA256

    2449bdedf691972e43f4ea34bc6aa905be406196e73c82bf248738acadf4240e

  • SHA512

    eafb00d41857bec881fb5d5549e67d0cedf93ba13edae90e29b0f0a165220a7a3e1b292913ae463a632ef254e7249b9db8af6c95e230b98d4678b0d96c4f643c

  • SSDEEP

    3072:/a/aMtDSsNSgg8vflKFBtqTI8x4ycD7iZAJE8tTY3tOc:ia/sN5xvflHJxTk7iZAJE8tTgO

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      2449bdedf691972e43f4ea34bc6aa905be406196e73c82bf248738acadf4240e

    • Size

      204KB

    • MD5

      9232c3a331afee1078a218943b581c16

    • SHA1

      169c4c5da07f7de97dac52b129bddd5608ff402b

    • SHA256

      2449bdedf691972e43f4ea34bc6aa905be406196e73c82bf248738acadf4240e

    • SHA512

      eafb00d41857bec881fb5d5549e67d0cedf93ba13edae90e29b0f0a165220a7a3e1b292913ae463a632ef254e7249b9db8af6c95e230b98d4678b0d96c4f643c

    • SSDEEP

      3072:/a/aMtDSsNSgg8vflKFBtqTI8x4ycD7iZAJE8tTY3tOc:ia/sN5xvflHJxTk7iZAJE8tTgO

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks