Overview

overview

10

Static

static

3

37b2da5073...9c.exe

windows7-x64

10

37b2da5073...9c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    37b2da507342c6928564cecf9c493b6b44c32b144a66f3a3fea3d52b79ba369c

  • Size

    3.1MB

  • Sample

    230817-lj9maaac9y

  • MD5

    cbf303739418078a02fa834827205dcc

  • SHA1

    4333aaacaf1e84385627f8fb57036f9dad556b5b

  • SHA256

    37b2da507342c6928564cecf9c493b6b44c32b144a66f3a3fea3d52b79ba369c

  • SHA512

    f809696588b116a39510b349e4002250e7071f05f507006f42b57335d07408528542d3b0ef4c648787d6a0f67c255d0dfc178f7223a9e9ad9d233de1e42b4c0f

  • SSDEEP

    98304:KRx0mbRXa2XUtOBIYuFREMsmEEFCcJuzsEFhrKrU6mehNaB0ItvZz+pTWJ7zw:XmbRXHeVEW3MrKrEYIJZz+pTWJ7zw

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      37b2da507342c6928564cecf9c493b6b44c32b144a66f3a3fea3d52b79ba369c

    • Size

      3.1MB

    • MD5

      cbf303739418078a02fa834827205dcc

    • SHA1

      4333aaacaf1e84385627f8fb57036f9dad556b5b

    • SHA256

      37b2da507342c6928564cecf9c493b6b44c32b144a66f3a3fea3d52b79ba369c

    • SHA512

      f809696588b116a39510b349e4002250e7071f05f507006f42b57335d07408528542d3b0ef4c648787d6a0f67c255d0dfc178f7223a9e9ad9d233de1e42b4c0f

    • SSDEEP

      98304:KRx0mbRXa2XUtOBIYuFREMsmEEFCcJuzsEFhrKrU6mehNaB0ItvZz+pTWJ7zw:XmbRXHeVEW3MrKrEYIJZz+pTWJ7zw

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks