Overview

overview

10

Static

static

1

0593205f46...b1.exe

windows7-x64

0593205f46...b1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0593205f46ae89d9dfd8aaac877478b1

  • Size

    94KB

  • Sample

    231229-2cqtlagef6

  • MD5

    0593205f46ae89d9dfd8aaac877478b1

  • SHA1

    2491ef8bbe5a42bfc291479e984b547b7c817ebc

  • SHA256

    8f71f460474603845d57395ac6afd08e17aae1bc247d381440611b7c6e1bbd38

  • SHA512

    2447ea5f4a7dbb5054f333fb8b81407ad26407ad8ad61c663000f06003502fe450a561f14abe6b9bd45643c7a21942bbe37f88dfed5e29f358ceb4b0f2184192

  • SSDEEP

    1536:LyGkiIOPaIKx2ZCSwLJRt2JTSpDBT22qVNgkoWA5JKkfTNUi8lIR2hbA2MmWGtd/:LyVi7RKx2MS4/tmsDqVikoWWJrrNUcRw

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      0593205f46ae89d9dfd8aaac877478b1

    • Size

      94KB

    • MD5

      0593205f46ae89d9dfd8aaac877478b1

    • SHA1

      2491ef8bbe5a42bfc291479e984b547b7c817ebc

    • SHA256

      8f71f460474603845d57395ac6afd08e17aae1bc247d381440611b7c6e1bbd38

    • SHA512

      2447ea5f4a7dbb5054f333fb8b81407ad26407ad8ad61c663000f06003502fe450a561f14abe6b9bd45643c7a21942bbe37f88dfed5e29f358ceb4b0f2184192

    • SSDEEP

      1536:LyGkiIOPaIKx2ZCSwLJRt2JTSpDBT22qVNgkoWA5JKkfTNUi8lIR2hbA2MmWGtd/:LyVi7RKx2MS4/tmsDqVikoWWJrrNUcRw

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks