Overview

overview

10

Static

static

fe03d7e20c...fb.exe

windows7-x64

10

fe03d7e20c...fb.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe03d7e20cce0fcf31deaf7a2d1ad5b9f15d13bd7e6f8bc0aa06bd988933a7fb

  • Size

    476KB

  • Sample

    221204-rql3fsbe8t

  • MD5

    f20feed080eea5e95e2c82ea73c036e1

  • SHA1

    cb04b622c69987a3b40d70612b2608f4a6c8982e

  • SHA256

    fe03d7e20cce0fcf31deaf7a2d1ad5b9f15d13bd7e6f8bc0aa06bd988933a7fb

  • SHA512

    699112e35bf865c5f01ca8d8d257ab8686c2c146ac6d1bbd95dabe3fc9a9d55ffb6be7755e1f1ae621f7a9bb63b242c2c4678fbd781b7906e7b5d7bd36a04dda

  • SSDEEP

    6144:GZbXGgeRu/HYMDUkR3GKvf8QLBBzAM+GuN8QpKPBxWQ:GZjGgeRu1DUIlLbzL+jkn

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      fe03d7e20cce0fcf31deaf7a2d1ad5b9f15d13bd7e6f8bc0aa06bd988933a7fb

    • Size

      476KB

    • MD5

      f20feed080eea5e95e2c82ea73c036e1

    • SHA1

      cb04b622c69987a3b40d70612b2608f4a6c8982e

    • SHA256

      fe03d7e20cce0fcf31deaf7a2d1ad5b9f15d13bd7e6f8bc0aa06bd988933a7fb

    • SHA512

      699112e35bf865c5f01ca8d8d257ab8686c2c146ac6d1bbd95dabe3fc9a9d55ffb6be7755e1f1ae621f7a9bb63b242c2c4678fbd781b7906e7b5d7bd36a04dda

    • SSDEEP

      6144:GZbXGgeRu/HYMDUkR3GKvf8QLBBzAM+GuN8QpKPBxWQ:GZjGgeRu1DUIlLbzL+jkn

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks