Overview

overview

10

Static

static

3

192eb3093e...cf.exe

windows7-x64

10

192eb3093e...cf.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    192eb3093e6d5ae995718c2efe6251cf

  • Size

    376KB

  • Sample

    231225-m4qkksbde3

  • MD5

    192eb3093e6d5ae995718c2efe6251cf

  • SHA1

    d8389e8d5c4f5decb0e67ff852f1269485930bb4

  • SHA256

    e0414923c79418878319e06ca8403c097280e9668eb3cb1d3b54650bc46dc43b

  • SHA512

    0c8d809ed0cefbf7946a07de21f5ca1b9b5086b9be7003d1b93c3ebb33e1aed0f795f4fdc714a0185436386eead646093fd0d3c4a9685fd23254b19d8d64c36b

  • SSDEEP

    6144:zIHYsZbS31zXqSNQgeiOKnDYVH0pwpMWEmpRBJ1NuUBY+f7zAF11whggaoHofphB:zIVZel6SOgeiOKEVH0ppWfBJ7XBczmRS

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      192eb3093e6d5ae995718c2efe6251cf

    • Size

      376KB

    • MD5

      192eb3093e6d5ae995718c2efe6251cf

    • SHA1

      d8389e8d5c4f5decb0e67ff852f1269485930bb4

    • SHA256

      e0414923c79418878319e06ca8403c097280e9668eb3cb1d3b54650bc46dc43b

    • SHA512

      0c8d809ed0cefbf7946a07de21f5ca1b9b5086b9be7003d1b93c3ebb33e1aed0f795f4fdc714a0185436386eead646093fd0d3c4a9685fd23254b19d8d64c36b

    • SSDEEP

      6144:zIHYsZbS31zXqSNQgeiOKnDYVH0pwpMWEmpRBJ1NuUBY+f7zAF11whggaoHofphB:zIVZel6SOgeiOKEVH0ppWfBJ7XBczmRS

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks