gh0strat | 74b103b8da44d7b608aee049d97937582fc9d9a70db5e3dfeb7cf95258a5a4f3 | Triage

Submit
Reports

Overview

overview

Static

static

3

74b103b8da...f3.exe

windows7-x64

74b103b8da...f3.exe

windows10-2004-x64

Sharing

General

Target

74b103b8da44d7b608aee049d97937582fc9d9a70db5e3dfeb7cf95258a5a4f3
Size

36KB
Sample

230524-w4qd9aea73
MD5

46b27885ea7d3fef93d48949bb201eae
SHA1

7cc03ea6cadabac5ee6dbe9bf9f2475705edfaa4
SHA256

74b103b8da44d7b608aee049d97937582fc9d9a70db5e3dfeb7cf95258a5a4f3
SHA512

86ad5f2ba61326b9dee70a41f6c50611488605497b8aac648eaca3fa3c7d62815e44f0347553d1a45d129e36b3ad76777f7dc5cae3abe53fe8d570af35fa8d37
SSDEEP

384:tg/M6HhPy+Jq5j01ULBxtzQyNQR61bMpYj8IxM:tg/5hPy3t01Ulu8bLj8IxM

Score

10^/10

gh0strat persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

74b103b8da44d7b608aee049d97937582fc9d9a70db5e3dfeb7cf95258a5a4f3.exe

Resource

win7-20230220-en

gh0strat persistence rat

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral2

Sample

74b103b8da44d7b608aee049d97937582fc9d9a70db5e3dfeb7cf95258a5a4f3.exe

Resource

win10v2004-20230220-en

gh0strat persistence rat

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  74b103b8da44d7b608aee049d97937582fc9d9a70db5e3dfeb7cf95258a5a4f3
- Size
  
  36KB
- MD5
  
  46b27885ea7d3fef93d48949bb201eae
- SHA1
  
  7cc03ea6cadabac5ee6dbe9bf9f2475705edfaa4
- SHA256
  
  74b103b8da44d7b608aee049d97937582fc9d9a70db5e3dfeb7cf95258a5a4f3
- SHA512
  
  86ad5f2ba61326b9dee70a41f6c50611488605497b8aac648eaca3fa3c7d62815e44f0347553d1a45d129e36b3ad76777f7dc5cae3abe53fe8d570af35fa8d37
- SSDEEP
  
  384:tg/M6HhPy+Jq5j01ULBxtzQyNQR61bMpYj8IxM:tg/5hPy3t01Ulu8bLj8IxM
Score

10^/10

gh0strat persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratpersistencerat

behavioral2

gh0stratpersistencerat

© 2018-2025

Terms | Privacy