Overview

overview

10

Static

static

1

028289b4af...b5.exe

windows7-x64

10

028289b4af...b5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    028289b4af9c7c35809b30f64b2367b5

  • Size

    95KB

  • Sample

    231229-ysgzvabfd6

  • MD5

    028289b4af9c7c35809b30f64b2367b5

  • SHA1

    c81fb7ddce0999bdbba1ce1767d487e1ce02659f

  • SHA256

    bb74a9bea6c71ce682c75baaef31165c06a8ed5ad780aab64449c812eb275475

  • SHA512

    ae5ef9bdb5a9e232fdf2c5066d93722d352ba392e8174c8b32c5162186e5b0ed0959726210313ac7bc1293da2c69483a50459408875ffdc84e987b1b68f91fa0

  • SSDEEP

    1536:fHFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prnMW5mb5EOs:fxS4jHS8q/3nTzePCwNUh4E9nWbGOs

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      028289b4af9c7c35809b30f64b2367b5

    • Size

      95KB

    • MD5

      028289b4af9c7c35809b30f64b2367b5

    • SHA1

      c81fb7ddce0999bdbba1ce1767d487e1ce02659f

    • SHA256

      bb74a9bea6c71ce682c75baaef31165c06a8ed5ad780aab64449c812eb275475

    • SHA512

      ae5ef9bdb5a9e232fdf2c5066d93722d352ba392e8174c8b32c5162186e5b0ed0959726210313ac7bc1293da2c69483a50459408875ffdc84e987b1b68f91fa0

    • SSDEEP

      1536:fHFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prnMW5mb5EOs:fxS4jHS8q/3nTzePCwNUh4E9nWbGOs

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks