Overview

overview

10

Static

static

10

c98359b768...c3.dll

windows7-x64

10

c98359b768...c3.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c98359b7682a37e7fd3872548f1b907088ae5cb3e582f396cb14bddc5ce89bc3

  • Size

    111KB

  • Sample

    221203-wh6jcafg3s

  • MD5

    0f1664738c09758d3c35e738722f6280

  • SHA1

    cc2f1e1c41efe341e764aa231e3aca4c59377de3

  • SHA256

    c98359b7682a37e7fd3872548f1b907088ae5cb3e582f396cb14bddc5ce89bc3

  • SHA512

    efc3e0dd2358526401b8f780479a8b3b40f0d75863ee83f91f8f47304fc629cb04b93e26f43100a9e636587a1c371c30aafd0e781e636aa50bba575c00f3ca18

  • SSDEEP

    3072:CwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwQ5iGH:JJVGpxx9b3wZuwQ4G

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      c98359b7682a37e7fd3872548f1b907088ae5cb3e582f396cb14bddc5ce89bc3

    • Size

      111KB

    • MD5

      0f1664738c09758d3c35e738722f6280

    • SHA1

      cc2f1e1c41efe341e764aa231e3aca4c59377de3

    • SHA256

      c98359b7682a37e7fd3872548f1b907088ae5cb3e582f396cb14bddc5ce89bc3

    • SHA512

      efc3e0dd2358526401b8f780479a8b3b40f0d75863ee83f91f8f47304fc629cb04b93e26f43100a9e636587a1c371c30aafd0e781e636aa50bba575c00f3ca18

    • SSDEEP

      3072:CwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwQ5iGH:JJVGpxx9b3wZuwQ4G

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks