Overview

overview

10

Static

static

e508507854...fe.exe

windows7-x64

10

e508507854...fe.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    e50850785467eb5e40b857657c5c147c29b2ef703a7c115e33cfcbfbae1970fe

  • Size

    272KB

  • Sample

    221204-rppf7afh83

  • MD5

    48773dbb62db6b3bfb0b79f47a47242a

  • SHA1

    84d60c6edd47bb61ac7a3481af99dbb6bfdcf4c4

  • SHA256

    e50850785467eb5e40b857657c5c147c29b2ef703a7c115e33cfcbfbae1970fe

  • SHA512

    e299a4504ca25c01ef0a3cc5af14b199e3236c8f75719d566a409d7a46e2dffb78a73433cb465aade3384fce9025c6df41ca0767e78364d8c88f35d8835cbaa9

  • SSDEEP

    3072:O0vVgD6dxaHpPGHZ87K02vdCfEgl5EpuuM95mrLP2Ul+HryFswxW3v68d01baQda:PvVge+JeHZL02vIM+EDMf/LnC8dCa

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      e50850785467eb5e40b857657c5c147c29b2ef703a7c115e33cfcbfbae1970fe

    • Size

      272KB

    • MD5

      48773dbb62db6b3bfb0b79f47a47242a

    • SHA1

      84d60c6edd47bb61ac7a3481af99dbb6bfdcf4c4

    • SHA256

      e50850785467eb5e40b857657c5c147c29b2ef703a7c115e33cfcbfbae1970fe

    • SHA512

      e299a4504ca25c01ef0a3cc5af14b199e3236c8f75719d566a409d7a46e2dffb78a73433cb465aade3384fce9025c6df41ca0767e78364d8c88f35d8835cbaa9

    • SSDEEP

      3072:O0vVgD6dxaHpPGHZ87K02vdCfEgl5EpuuM95mrLP2Ul+HryFswxW3v68d01baQda:PvVge+JeHZL02vIM+EDMf/LnC8dCa

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks