Overview

overview

10

Static

static

10

5b36d319f0...dc.exe

windows7-x64

10

5b36d319f0...dc.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5b36d319f08cb3523cd4c8b8bc6adfdc

  • Size

    136KB

  • Sample

    231226-htkjcsbba6

  • MD5

    5b36d319f08cb3523cd4c8b8bc6adfdc

  • SHA1

    c154ede9834efbf578cc2101c5767e4cd1547603

  • SHA256

    e2979b7a357e44fbfe67d594642795be04be405adbc7a0251041d09431c85757

  • SHA512

    603157b0388e18e705283dce9998b0f60d94b60bba83adbf53f168843fe99cb205d745420e8e0473c98ca2742d396a9350b0716a99c937069ef775d2a34040f5

  • SSDEEP

    3072:3fimN4pPXIRVan6rmDikUvDirOoMAFG5B7aCJq5Yx:bIuChD7LOoMAFi7ow

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      5b36d319f08cb3523cd4c8b8bc6adfdc

    • Size

      136KB

    • MD5

      5b36d319f08cb3523cd4c8b8bc6adfdc

    • SHA1

      c154ede9834efbf578cc2101c5767e4cd1547603

    • SHA256

      e2979b7a357e44fbfe67d594642795be04be405adbc7a0251041d09431c85757

    • SHA512

      603157b0388e18e705283dce9998b0f60d94b60bba83adbf53f168843fe99cb205d745420e8e0473c98ca2742d396a9350b0716a99c937069ef775d2a34040f5

    • SSDEEP

      3072:3fimN4pPXIRVan6rmDikUvDirOoMAFG5B7aCJq5Yx:bIuChD7LOoMAFi7ow

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks