Overview

overview

10

Static

static

10

226b527591...4c.exe

windows7-x64

10

226b527591...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    226b5275911dc1fd39a97be3d5f8004c

  • Size

    878KB

  • Sample

    231231-bb7slscgh8

  • MD5

    226b5275911dc1fd39a97be3d5f8004c

  • SHA1

    1a55b684bdf20a62a5cf42e1a6f14280966d2584

  • SHA256

    c2b9de39a0f0a463772d2c879fb4a2b8d1b0575212424a896eb06bbf7906a9ee

  • SHA512

    b66832c7d198d3532e7c7d6cdb25a50b6fcc27fc2b41aa70e731f73276b53ebfb09826f55098ad06222b8439269f9b4b4661664519ab0105e0b5745006284942

  • SSDEEP

    12288:/M5REAfL3aKHx5r+TuxXzNWJBhiFHzsVK2oAuD:/M5RE23aKHx5r+TuxXzcBsFHUoAuD

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      226b5275911dc1fd39a97be3d5f8004c

    • Size

      878KB

    • MD5

      226b5275911dc1fd39a97be3d5f8004c

    • SHA1

      1a55b684bdf20a62a5cf42e1a6f14280966d2584

    • SHA256

      c2b9de39a0f0a463772d2c879fb4a2b8d1b0575212424a896eb06bbf7906a9ee

    • SHA512

      b66832c7d198d3532e7c7d6cdb25a50b6fcc27fc2b41aa70e731f73276b53ebfb09826f55098ad06222b8439269f9b4b4661664519ab0105e0b5745006284942

    • SSDEEP

      12288:/M5REAfL3aKHx5r+TuxXzNWJBhiFHzsVK2oAuD:/M5RE23aKHx5r+TuxXzcBsFHUoAuD

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks