Overview

overview

10

Static

static

7

11eacb8e42...26.exe

windows7-x64

10

11eacb8e42...26.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11eacb8e421fbc90070634853b734c26.exe

  • Size

    768KB

  • Sample

    230324-hh3ksscg36

  • MD5

    11eacb8e421fbc90070634853b734c26

  • SHA1

    285fc883e56317aeb1200a63f11535495ed7c04d

  • SHA256

    fcbf0434298b9bac4e986835686ae0af18231736c4fe218cd4ef75ebe3e68c8f

  • SHA512

    a0231e70b4a88730f8e976864431e8e960ed840164a02e95c4f76889676c42031e597041bb17e0ccec7f07800bf8a41b988a3374fce868ebfc9484db8e34bc5f

  • SSDEEP

    12288:UgEAT7WiE9oDAGh9KvcX7wu1CgtIjvQuFv2UTpcEfZ6IKbfynbF+h3s6BOZ1m+Zb:J3m9s99L7wu1tsvz2UeQZ6IKWZ+doW+o

Score
10/10
gh0stratratvmprotect

Malware Config

Extracted

Family

gh0strat

C2

3012.qmananan.com

Targets

    • Target

      11eacb8e421fbc90070634853b734c26.exe

    • Size

      768KB

    • MD5

      11eacb8e421fbc90070634853b734c26

    • SHA1

      285fc883e56317aeb1200a63f11535495ed7c04d

    • SHA256

      fcbf0434298b9bac4e986835686ae0af18231736c4fe218cd4ef75ebe3e68c8f

    • SHA512

      a0231e70b4a88730f8e976864431e8e960ed840164a02e95c4f76889676c42031e597041bb17e0ccec7f07800bf8a41b988a3374fce868ebfc9484db8e34bc5f

    • SSDEEP

      12288:UgEAT7WiE9oDAGh9KvcX7wu1CgtIjvQuFv2UTpcEfZ6IKbfynbF+h3s6BOZ1m+Zb:J3m9s99L7wu1tsvz2UeQZ6IKWZ+doW+o

    Score
    10/10
    gh0stratratvmprotect

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks