Overview

overview

10

Static

static

6c15f740db...24.exe

windows7-x64

10

6c15f740db...24.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6c15f740db5c77dd0cc23e9b6dd8af5be062546b73617ffa0115eac37ddda824

  • Size

    497KB

  • Sample

    221205-z19khagc93

  • MD5

    ddb9c6918f666f071b82646d2d8902ed

  • SHA1

    4a7c6b4d534cc60aad227131cba2321ff8a2ec7c

  • SHA256

    6c15f740db5c77dd0cc23e9b6dd8af5be062546b73617ffa0115eac37ddda824

  • SHA512

    a8d63659ddb847e1393ad585b4e9df572e0a77783404a46d2d3a63c99aec6868de30caa82c9f4bc10feeab68dd974dffbf8f4c1bb605a4ccb20ae35afb51adb7

  • SSDEEP

    6144:7evzV8Yct6Ym5OjI6UOwqdC32bAAzMFBR:7e7V8rzmb6URlizUBR

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      6c15f740db5c77dd0cc23e9b6dd8af5be062546b73617ffa0115eac37ddda824

    • Size

      497KB

    • MD5

      ddb9c6918f666f071b82646d2d8902ed

    • SHA1

      4a7c6b4d534cc60aad227131cba2321ff8a2ec7c

    • SHA256

      6c15f740db5c77dd0cc23e9b6dd8af5be062546b73617ffa0115eac37ddda824

    • SHA512

      a8d63659ddb847e1393ad585b4e9df572e0a77783404a46d2d3a63c99aec6868de30caa82c9f4bc10feeab68dd974dffbf8f4c1bb605a4ccb20ae35afb51adb7

    • SSDEEP

      6144:7evzV8Yct6Ym5OjI6UOwqdC32bAAzMFBR:7e7V8rzmb6URlizUBR

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks