Overview

overview

10

Static

static

10

7950f8d466...8b.exe

windows7-x64

10

7950f8d466...8b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7950f8d46685238d0d7393cc708f5f8625b1f80c8a66a38260abc1fff72b328b

  • Size

    149KB

  • Sample

    221206-cb3pbsba3y

  • MD5

    cb7f2c659a2216e3cddfbf122334fb8b

  • SHA1

    c9c725a0c09f21f1aa34525cc1b57d5a79925db6

  • SHA256

    7950f8d46685238d0d7393cc708f5f8625b1f80c8a66a38260abc1fff72b328b

  • SHA512

    6d618eae2770fe0550749685ffc0a67e51397f699bad9c92d446b629d0d0b60411f11ac640b8b3d21eda5fe0d28d03b071f0d137aab77bb41d92afe8ee446903

  • SSDEEP

    3072:P2T7uCWOhANdpgMxsdSyg4TvtcMk8Lyzb8ckivlu5K6iCbmN:PW7uCWOh4pl2GkGMkSgb8Svlu5K6ON

Score
10/10
gh0stratpersistenceratupx

Malware Config

Targets

    • Target

      7950f8d46685238d0d7393cc708f5f8625b1f80c8a66a38260abc1fff72b328b

    • Size

      149KB

    • MD5

      cb7f2c659a2216e3cddfbf122334fb8b

    • SHA1

      c9c725a0c09f21f1aa34525cc1b57d5a79925db6

    • SHA256

      7950f8d46685238d0d7393cc708f5f8625b1f80c8a66a38260abc1fff72b328b

    • SHA512

      6d618eae2770fe0550749685ffc0a67e51397f699bad9c92d446b629d0d0b60411f11ac640b8b3d21eda5fe0d28d03b071f0d137aab77bb41d92afe8ee446903

    • SSDEEP

      3072:P2T7uCWOhANdpgMxsdSyg4TvtcMk8Lyzb8ckivlu5K6iCbmN:PW7uCWOh4pl2GkGMkSgb8Svlu5K6ON

    Score
    10/10
    gh0stratpersistenceratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks