Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
23/08/2023, 06:39
General
-
Target
bf737e03f05cafccff572cf6279eb6bb1ad4a1b286775c9fc58248193a97df97.exe
-
Size
499KB
-
MD5
2096358aa0798c54719a6781f1c8ae6b
-
SHA1
b8402e64c1f48f8d83303677d052020431e5b321
-
SHA256
bf737e03f05cafccff572cf6279eb6bb1ad4a1b286775c9fc58248193a97df97
-
SHA512
d2516cda76906720083c2579aa0e29978683fea86fd7959bca04b3522430ca79a9d2f6df50dd627da3016db1fa6239ee23538f08ffebd767471ac454fea3a005
-
SSDEEP
6144:SdTzBdYBPum2ZRqjZg4O4V7eXB3Juyjn5deo6w:SZ96utvctA3Juyjnp
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf737e03f05cafccff572cf6279eb6bb1ad4a1b286775c9fc58248193a97df97.exe"C:\Users\Admin\AppData\Local\Temp\bf737e03f05cafccff572cf6279eb6bb1ad4a1b286775c9fc58248193a97df97.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
704KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
704KB
-
Filesize
4KB
-
Filesize
68KB
-
Filesize
68KB