Overview

overview

10

Static

static

1

56693b2363...af.exe

windows7-x64

10

56693b2363...af.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56693b2363024dd47e0f13d4f93ddebc0bbf65b896eb22636641d03aad7bf8af.zip

  • Size

    74KB

  • Sample

    230321-ryt32abb78

  • MD5

    abeebb2b9d9237bb68317ca5ea6bda50

  • SHA1

    47984e7eb6434f14f88c1b7b44faf81df3d3c9ed

  • SHA256

    03e2c418cb3172abe01433d974f3204dda1f54377b0c54a30ca96f82c2d6309a

  • SHA512

    1500cbda96127d995a311ec99eaf961e30b294d9c0d31f9e7cb83ae439c0eb8f82982debb6de2a531ab3a5b96bc2d7c898a5bada4a9112356f37f46883961bd3

  • SSDEEP

    1536:91pUNKWkN/+isVVWD+pnv0erO1Fkjg4WciEhnVZxBSnaZUD0skbg:91KoV8XWDpjgBWvUQn/b

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      56693b2363024dd47e0f13d4f93ddebc0bbf65b896eb22636641d03aad7bf8af.exe

    • Size

      80KB

    • MD5

      393f2fb9401919be93d8c80478326cfc

    • SHA1

      d2e5c2d5b3fceb69a0a49603ebc6239a003a934a

    • SHA256

      56693b2363024dd47e0f13d4f93ddebc0bbf65b896eb22636641d03aad7bf8af

    • SHA512

      4daf67557badb91007f64f49c7f3b13230234f8f2717fd20e476661dfa2db448f06d57927c8e881efb6afe96823b25784370f926363cefabcc85bf5c57a6483b

    • SSDEEP

      1536:kFz0LnC0atiq+9Cc73McaTBFb0bJ+oa/xrpnHTlyojsjxNe22JjIHMl:kFz90hq+Yc7Hf4oa5r5sojsj+oMl

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks