Extracted

• • Target

    a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1

  • Size

    376KB

  • MD5

    674baf399497aa2f28c5f710b8aa48e3

  • SHA1

    f9f1197d09cb35d08370c07abd9b41b52cfc3018

  • SHA256

    a734a09cb77fcebf23e2817c703cb701b99a4aacef04e40f6adbaf82846651f1

  • SHA512

    b7f0af05dae9e944da36bf3a4ce21c750aaa6bdaf2a989ca4e1d4f62ffa7a2fe105dff0804ab9c6b0a30559418dc6b692e15630bf7fbceb30877f12530b6a6a3

  • SSDEEP

    3072:RvK/yLrQbWaR5Qax8c/YtDZiftPRAqE3PC8tSoUOKK:ROyLEbWaR5CceifXc3PXS/OKK

  Score

  10^/10

  gh0stratratpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2