Analysis
-
max time kernel
250s -
max time network
291s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
04-12-2022 01:37
General
-
Target
f5161c7a7c039a26dbe5f8c8169ebff2d03a03c224ff4c238c0e0bdd163ec202.exe
-
Size
134KB
-
MD5
f2603da9a089e3511fdb94a867664ba4
-
SHA1
c6aa5c4fb170547e4a865f29789a8b558098704c
-
SHA256
f5161c7a7c039a26dbe5f8c8169ebff2d03a03c224ff4c238c0e0bdd163ec202
-
SHA512
796d4b82122361da7f4b5b63072a72dfddedbaf2cc21850a76882c29588c091900bd75df8efea7f87342b0bda5ac34b3f7377e0cf53f6fa945a6bb438d5b17c1
-
SSDEEP
3072:XHJop67/l26U8Fj+rW6MngUi0k0lKkozwkpgRwqMfNd:3gvH9UHrKkqwk6iqMf
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5161c7a7c039a26dbe5f8c8169ebff2d03a03c224ff4c238c0e0bdd163ec202.exe"C:\Users\Admin\AppData\Local\Temp\f5161c7a7c039a26dbe5f8c8169ebff2d03a03c224ff4c238c0e0bdd163ec202.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
-
Filesize
148KB