Overview

overview

10

Static

static

10

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    112KB

  • Sample

    230129-t2g9radg78

  • MD5

    67dfc7730a6d14715de7b28db5f23c0b

  • SHA1

    d958daeef153d07f1b5013ec2e2d8833360874c3

  • SHA256

    47adf8083f73c20364fb88abce106f4e2126dbb08be18d0a066a9a8fc10ec436

  • SHA512

    edb7d3b61aa7b3c2163f88516aef3ef941a98e7b2f5eaf9a8ba427b48566971b273a43277e738cb52b6602dd67b0bd998d4b4da38065db56c0b7429e292b0a55

  • SSDEEP

    1536:vqEA70HzLJksPEOajozLElnqiO27dJ/tHi:vXTLJkQ7zAV3HtC

Score
10/10
gh0stratrunningratpersistencerat

Malware Config

Targets

    • Target

      tmp

    • Size

      112KB

    • MD5

      67dfc7730a6d14715de7b28db5f23c0b

    • SHA1

      d958daeef153d07f1b5013ec2e2d8833360874c3

    • SHA256

      47adf8083f73c20364fb88abce106f4e2126dbb08be18d0a066a9a8fc10ec436

    • SHA512

      edb7d3b61aa7b3c2163f88516aef3ef941a98e7b2f5eaf9a8ba427b48566971b273a43277e738cb52b6602dd67b0bd998d4b4da38065db56c0b7429e292b0a55

    • SSDEEP

      1536:vqEA70HzLJksPEOajozLElnqiO27dJ/tHi:vXTLJkQ7zAV3HtC

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Creates a Windows Service

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks