Overview

overview

10

Static

static

3

210709bfa1...f4.exe

windows7-x64

10

210709bfa1...f4.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    210709bfa14329c63ff27eed065186f4

  • Size

    787KB

  • Sample

    231231-ac8kvscee7

  • MD5

    210709bfa14329c63ff27eed065186f4

  • SHA1

    f759f4a2d3c4537db981d5654ea2e0154e294243

  • SHA256

    b962af838bdfeaef41404d5c59b9ddc485f146925955f76f1ecc63df24ddf2d7

  • SHA512

    828e4cb3e558a6589795edc953feea5c651aa74db098cd943d7381fea5ad3db7bc9082446cdf20b9bce72acf22294c01a55178a7eb06979c1e920b5407399bad

  • SSDEEP

    24576:pjAvvLUuVg1dkmAVxLCoqlFLJHDpnQmxIlho:9AvvLu1y/fLC3tPul

Score
10/10
gh0stratevasionrat

Malware Config

Targets

    • Target

      210709bfa14329c63ff27eed065186f4

    • Size

      787KB

    • MD5

      210709bfa14329c63ff27eed065186f4

    • SHA1

      f759f4a2d3c4537db981d5654ea2e0154e294243

    • SHA256

      b962af838bdfeaef41404d5c59b9ddc485f146925955f76f1ecc63df24ddf2d7

    • SHA512

      828e4cb3e558a6589795edc953feea5c651aa74db098cd943d7381fea5ad3db7bc9082446cdf20b9bce72acf22294c01a55178a7eb06979c1e920b5407399bad

    • SSDEEP

      24576:pjAvvLUuVg1dkmAVxLCoqlFLJHDpnQmxIlho:9AvvLu1y/fLC3tPul

    Score
    10/10
    gh0stratevasionrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks