Overview

overview

10

Static

static

1

2a20fbd26d...56.exe

windows7-x64

10

2a20fbd26d...56.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2a20fbd26dc1af2d14a2e569073dc256

  • Size

    265KB

  • Sample

    231225-s497wahhdl

  • MD5

    2a20fbd26dc1af2d14a2e569073dc256

  • SHA1

    6f6fdccf8a90b0a3de8e2147a3a712206950d77a

  • SHA256

    29a45529e7882ca1a41ebe6780600fb26c3339c667f6f41c841a65a1b4b14905

  • SHA512

    eb5027bb77490647001e958d1a3cfb4084920360a1f2b03ab8afcc08b557c8e619bb39d29ca823e0569948a706682ffef5591fe24642c25b1f02c1ee432fe124

  • SSDEEP

    6144:/KGgeyXPoBQfFME3TJ5FeKMsHleE8wUV8wD46:yGge8oiacvHHCwa8wf

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      2a20fbd26dc1af2d14a2e569073dc256

    • Size

      265KB

    • MD5

      2a20fbd26dc1af2d14a2e569073dc256

    • SHA1

      6f6fdccf8a90b0a3de8e2147a3a712206950d77a

    • SHA256

      29a45529e7882ca1a41ebe6780600fb26c3339c667f6f41c841a65a1b4b14905

    • SHA512

      eb5027bb77490647001e958d1a3cfb4084920360a1f2b03ab8afcc08b557c8e619bb39d29ca823e0569948a706682ffef5591fe24642c25b1f02c1ee432fe124

    • SSDEEP

      6144:/KGgeyXPoBQfFME3TJ5FeKMsHleE8wUV8wD46:yGge8oiacvHHCwa8wf

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks