gh0strat

General

Target

a.bin
Size

5KB
Sample

230514-wtjtqacf85
MD5

551f6c82be37595d7adc60f3963aa8f8
SHA1

2fcda63f89e8787702d4873c13ec9d009d061bc5
SHA256

9024a6e56532e25f34f6e96fa124048eb099fde8385d44e53bbaf1d36f63b7a1
SHA512

63e613610c9eb3b074c67f130969e6ff7917f239f47eeee3685932ec671bf98c1d0216b6eee2a6e712d1a953c32968fd30bb241809cab97da880c72e918abe97
SSDEEP

48:6Zi2oYDjX9iqhf3FXfkQHjJhyPFlWa8tYDdqIYq/cphuOulavTqXSfbNtm:CNiqp3JkQHyDUtE2AcpisvNzNt

Score

10^/10

Malware Config

Extracted

Family

redline

Botnet

Payment

C2

194.87.151.214:2020

Extracted

Family

redline

Botnet

@crluu7

C2

167.235.158.92:45741

Attributes

auth_value
7edd58fa8647e5797eab93a58f7cdd82

Extracted

Family

redline

Botnet

linda

C2

185.161.248.75:4132

Attributes

auth_value
21cdc21d041667b9c1679f88a1146770

Extracted

Family

raccoon

Botnet

5b7eff386f31487f5db4c7f0e4006546

C2

http://165.232.118.86/

xor.plain

Extracted

Family

lokibot

C2

http://171.22.30.164/mancho/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Targets

- Target
  
  a.bin
- Size
  
  5KB
- MD5
  
  551f6c82be37595d7adc60f3963aa8f8
- SHA1
  
  2fcda63f89e8787702d4873c13ec9d009d061bc5
- SHA256
  
  9024a6e56532e25f34f6e96fa124048eb099fde8385d44e53bbaf1d36f63b7a1
- SHA512
  
  63e613610c9eb3b074c67f130969e6ff7917f239f47eeee3685932ec671bf98c1d0216b6eee2a6e712d1a953c32968fd30bb241809cab97da880c72e918abe97
- SSDEEP
  
  48:6Zi2oYDjX9iqhf3FXfkQHjJhyPFlWa8tYDdqIYq/cphuOulavTqXSfbNtm:CNiqp3JkQHyDUtE2AcpisvNzNt
Score

10^/10

gh0strat lokibot raccoon redline sectoprat wshrat 5b7eff386f31487f5db4c7f0e4006546 @crluu7 linda payment evasion infostealer persistence ransomware rat spyware stealer trojan
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- WSHRAT
  WSHRAT is a variant of Houdini worm and has vbs and js variants.
  trojan wshrat
- WSHRAT payload
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- Stops running service(s)
  evasion
- Executes dropped EXE
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1