Extracted

• • Target

    NEAS.4c6a749789a8812561ee6d5ad511e430.exe

  • Size

    964KB

  • MD5

    4c6a749789a8812561ee6d5ad511e430

  • SHA1

    d74784915583eabbc6c1118979da92f17b73e6a9

  • SHA256

    fcafdb31ef7cc7b76a86db6e0f49971058339baf41904e6f3cfa14f47f5da1cd

  • SHA512

    8e8a10f880307917436771166e450f6d8ffd3aba284bc0c0ed509c882b45957715640ef5d043d46a29f51ef476a6ccfc9ea31765284338e3de03bef75ed0a6ea

  • SSDEEP

    24576:3LWwz5awaq/+OrLC7np+ysI/bivSFDt8MfNGHEml6kb:3L95atOJrLC7p+ybiq1t8MfNG5db

  Score

  10^/10

  gh0stratratpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2