Overview

overview

10

Static

static

a263198c35...3e.exe

windows7-x64

8

a263198c35...3e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a263198c3540ca0e3b1a45c9726746c0745707b099425b99396273befd93ea3e

  • Size

    96KB

  • Sample

    221203-ts9yeafc59

  • MD5

    60e4922b223dcf281e195866bd0e4814

  • SHA1

    0fa09c51403f00b5c0b7b5381234ea24b98bf854

  • SHA256

    a263198c3540ca0e3b1a45c9726746c0745707b099425b99396273befd93ea3e

  • SHA512

    f306d5eb8f523ed47b6646a12ebfd16dc496451649d83a7c27bfc9267e711cc076fbdf51de7015b2301f3668bf5a098767ddc8ebf073dc14e219b50b2afc2e60

  • SSDEEP

    1536:i3FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prjqNYg:iBS4jHS8q/3nTzePCwNUh4E9SYg

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      a263198c3540ca0e3b1a45c9726746c0745707b099425b99396273befd93ea3e

    • Size

      96KB

    • MD5

      60e4922b223dcf281e195866bd0e4814

    • SHA1

      0fa09c51403f00b5c0b7b5381234ea24b98bf854

    • SHA256

      a263198c3540ca0e3b1a45c9726746c0745707b099425b99396273befd93ea3e

    • SHA512

      f306d5eb8f523ed47b6646a12ebfd16dc496451649d83a7c27bfc9267e711cc076fbdf51de7015b2301f3668bf5a098767ddc8ebf073dc14e219b50b2afc2e60

    • SSDEEP

      1536:i3FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prjqNYg:iBS4jHS8q/3nTzePCwNUh4E9SYg

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks