Extracted

• • Target

    New_4.8.10.exe

  • Size

    124.3MB

  • MD5

    f89701701ace82ef08972d55b68e232f

  • SHA1

    084888e907329c480518220990fc4a8dcd108463

  • SHA256

    a896be695060cae32a70973ebba049139b27ae837e870e5faf728392b32854dd

  • SHA512

    f5f9e7b1f6ae0e5983a58c91be5558feb10bb07ffa10a289580759cc1abba8c829d7f9752873c62fbb0f552119e5fc9ebe3a02cdb649919d1743ee933bc49bf1

  • SSDEEP

    3145728:dRrHJ5u0UJ140kRRGtBOPMx332CVB4JeMz9MrI/:dRrHb/UJSrR8hbxPrI/

  Score

  10^/10

  gh0stratratupx

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  behavioral1behavioral2behavioral3