Overview

overview

10

Static

static

10

aa8d6c5123...b6.exe

windows7-x64

10

aa8d6c5123...b6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6

  • Size

    108KB

  • Sample

    221204-v428daef3w

  • MD5

    0e1ccb59daeffd4c3f95f265f0fc2c3c

  • SHA1

    a898f0b55a807a4a963fbb74457041134d987790

  • SHA256

    aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6

  • SHA512

    087796f8a48cd9caf0de1a1a21b38fb0f2223103241997ffdba16c58eb8e86238654b9bd1935bdfb9ce8d02eecf625e3a24b3e58e7567947d00aa106daad95c0

  • SSDEEP

    3072:nEDp5IucmVVLVTuoKem/1EQ6vEpvHa3Ha16nzJ:nyp5IucmVVLVxj6HTpf716F

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6

    • Size

      108KB

    • MD5

      0e1ccb59daeffd4c3f95f265f0fc2c3c

    • SHA1

      a898f0b55a807a4a963fbb74457041134d987790

    • SHA256

      aa8d6c51236f9b97959a8e963d4573c6cb41ceff9532ab3cc5ad18d70c5ddeb6

    • SHA512

      087796f8a48cd9caf0de1a1a21b38fb0f2223103241997ffdba16c58eb8e86238654b9bd1935bdfb9ce8d02eecf625e3a24b3e58e7567947d00aa106daad95c0

    • SSDEEP

      3072:nEDp5IucmVVLVTuoKem/1EQ6vEpvHa3Ha16nzJ:nyp5IucmVVLVxj6HTpf716F

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks