Overview

overview

10

Static

static

3

524569e1ca...73.exe

windows7-x64

10

524569e1ca...73.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    524569e1ca4622fb87f941b7ebc83073

  • Size

    136KB

  • Sample

    231226-ejadvsbgf7

  • MD5

    524569e1ca4622fb87f941b7ebc83073

  • SHA1

    8cc1e050e2d144198f0fc63feae2e9db41ddc433

  • SHA256

    9466d0d03e8da2a11d1d2238415842aa20ad6d4606b2405d8a4763e27f1108b3

  • SHA512

    f176cc86d85100936537f64c63021ffea7ae72a4be7fc8a652ac7ba921e65286c5509fe9ac3c742e92c2ca122751c7d37c869045069f4c04c3325aed72e32aea

  • SSDEEP

    1536:HsOdzeCT5L27tvVBAJ1mcnHnmKaQRmcGCvC9p6bm++RpiY64vKDlh+sWLvvuIY7v:MOd6CT5C7/gGKaQRlGCZHYWDSkISQ+

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      524569e1ca4622fb87f941b7ebc83073

    • Size

      136KB

    • MD5

      524569e1ca4622fb87f941b7ebc83073

    • SHA1

      8cc1e050e2d144198f0fc63feae2e9db41ddc433

    • SHA256

      9466d0d03e8da2a11d1d2238415842aa20ad6d4606b2405d8a4763e27f1108b3

    • SHA512

      f176cc86d85100936537f64c63021ffea7ae72a4be7fc8a652ac7ba921e65286c5509fe9ac3c742e92c2ca122751c7d37c869045069f4c04c3325aed72e32aea

    • SSDEEP

      1536:HsOdzeCT5L27tvVBAJ1mcnHnmKaQRmcGCvC9p6bm++RpiY64vKDlh+sWLvvuIY7v:MOd6CT5C7/gGKaQRlGCZHYWDSkISQ+

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks