Overview

overview

10

Static

static

c38aac1c52...e9.exe

windows7-x64

8

c38aac1c52...e9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c38aac1c52c1b313bed6db01e41be4c4c0d45296efdbd2320703165a0c3ddbe9

  • Size

    95KB

  • Sample

    221203-gbt5each8y

  • MD5

    afcf3ef97fb9c0cc53279765fe4a2d9a

  • SHA1

    7f88bca8d0a7c4e18f8e029c3114fb0d2ecd210b

  • SHA256

    c38aac1c52c1b313bed6db01e41be4c4c0d45296efdbd2320703165a0c3ddbe9

  • SHA512

    7929572325cf2aed99eee1ac844017fa30bfedcec165e6b8b9e7664aa1d86cde94f365015b5c0bd2cbac425abe90595695cf9d0054af5f1908033ea7d0c30501

  • SSDEEP

    1536:a5FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pr788+/E:avS4jHS8q/3nTzePCwNUh4E978r/E

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      c38aac1c52c1b313bed6db01e41be4c4c0d45296efdbd2320703165a0c3ddbe9

    • Size

      95KB

    • MD5

      afcf3ef97fb9c0cc53279765fe4a2d9a

    • SHA1

      7f88bca8d0a7c4e18f8e029c3114fb0d2ecd210b

    • SHA256

      c38aac1c52c1b313bed6db01e41be4c4c0d45296efdbd2320703165a0c3ddbe9

    • SHA512

      7929572325cf2aed99eee1ac844017fa30bfedcec165e6b8b9e7664aa1d86cde94f365015b5c0bd2cbac425abe90595695cf9d0054af5f1908033ea7d0c30501

    • SSDEEP

      1536:a5FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pr788+/E:avS4jHS8q/3nTzePCwNUh4E978r/E

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks