Overview

overview

10

Static

static

c660ace33b...e9.exe

windows7-x64

10

c660ace33b...e9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9

  • Size

    1.6MB

  • Sample

    221204-a7dnzaga6t

  • MD5

    47265030482ff347272cdf09aef25e8d

  • SHA1

    2ae7ac78dc11f0374389f1f15031a1a1a4d30b70

  • SHA256

    c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9

  • SHA512

    35c09678bde4841c3bc0432229c6b84bd4ca39c963290cfcc7d25bb6b10002346e0dc798c684bf9d3ab95b4e286f5366430758733ee2f33eb8610e9773e78b0e

  • SSDEEP

    24576:U61I7CpxnYP1uyFQ3OfzYSu2+PVAJeA4Qsi84XVKCuVSs1DKNbGvFic2Y+O:D+7vdNwERuDrZQsN4YpSKWG9ic2Yl

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9

    • Size

      1.6MB

    • MD5

      47265030482ff347272cdf09aef25e8d

    • SHA1

      2ae7ac78dc11f0374389f1f15031a1a1a4d30b70

    • SHA256

      c660ace33bc9a82ff6b0f600b7cede4b533c72721ab31758b1775eb6757662e9

    • SHA512

      35c09678bde4841c3bc0432229c6b84bd4ca39c963290cfcc7d25bb6b10002346e0dc798c684bf9d3ab95b4e286f5366430758733ee2f33eb8610e9773e78b0e

    • SSDEEP

      24576:U61I7CpxnYP1uyFQ3OfzYSu2+PVAJeA4Qsi84XVKCuVSs1DKNbGvFic2Y+O:D+7vdNwERuDrZQsN4YpSKWG9ic2Yl

    Score
    10/10
    gh0stratratpersistence

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks