Extracted

• • Target

    5637b80c6dfa6a096df3684c7fcf0309.exe

  • Size

    888KB

  • MD5

    5637b80c6dfa6a096df3684c7fcf0309

  • SHA1

    bb9feca97658ba25e31677f7844692ef4b9d9e63

  • SHA256

    2166039dff43718f7ec551e93353c1c439a5299a9afdad6286ea6e3054ae7f0c

  • SHA512

    4d85f9d1903569434907fff75b2bc48c13e609d0429f521411de968e5ac05e940ed0cd6c201f8df47fd18d9d863a892ac11a38b29f18ca12e333da9a969a0f75

  • SSDEEP

    12288:WXwncX7nekNJyECJlBfsyiSLb0b3w99n/3GYECzqFwdFslbDeYFKi8xlzxrC5VB:WXccFnyBflRb0s99nJADv0Vjl

  Score

  10^/10

  gh0stratratvmprotect

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2