Overview

overview

10

Static

static

e903cc9243...df.exe

windows7-x64

8

e903cc9243...df.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e903cc9243798e9af90a0c93f9c62bd001a597c39e4cd95e3fe25b40eed237df

  • Size

    94KB

  • Sample

    221204-p5gp6sef4v

  • MD5

    68212e83c004e10fa0a30f53782d48a5

  • SHA1

    56a4b6deb1d832ff101d38589eda257752bd0ffe

  • SHA256

    e903cc9243798e9af90a0c93f9c62bd001a597c39e4cd95e3fe25b40eed237df

  • SHA512

    84c3822a02ad2da2a8befd1dcc2fddeb3033a561a8170d36e3073e5dfee528f3d5eaa8df8378a4f6613e3ded2d73a3f0485b51728842e50bdb95305cf936a33a

  • SSDEEP

    1536:bklFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prfJgGzgIzDgm:bkrS4jHS8q/3nTzePCwNUh4E9jgADj

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      e903cc9243798e9af90a0c93f9c62bd001a597c39e4cd95e3fe25b40eed237df

    • Size

      94KB

    • MD5

      68212e83c004e10fa0a30f53782d48a5

    • SHA1

      56a4b6deb1d832ff101d38589eda257752bd0ffe

    • SHA256

      e903cc9243798e9af90a0c93f9c62bd001a597c39e4cd95e3fe25b40eed237df

    • SHA512

      84c3822a02ad2da2a8befd1dcc2fddeb3033a561a8170d36e3073e5dfee528f3d5eaa8df8378a4f6613e3ded2d73a3f0485b51728842e50bdb95305cf936a33a

    • SSDEEP

      1536:bklFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prfJgGzgIzDgm:bkrS4jHS8q/3nTzePCwNUh4E9jgADj

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks