Overview

overview

10

Static

static

10

63934ae4c2...86.exe

windows7-x64

10

63934ae4c2...86.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    63934ae4c23ad5c1c1d9c2343dfc3b86

  • Size

    112KB

  • Sample

    240117-zna66sedar

  • MD5

    63934ae4c23ad5c1c1d9c2343dfc3b86

  • SHA1

    259b53bc64607d6fe2e1aae7e8d5385bf794599e

  • SHA256

    98c0d0317cb20daab2ceb8167c6e95eed9b332f1423c79a06d57bca9abb339de

  • SHA512

    577dd4cf4aa1705648ce12f6762521a0baafb01965b2165995d2c721e8989d502b5da24401253e83bee36196ef232d42bb638149bf86d9dbf1b6a672a7a130cf

  • SSDEEP

    3072:ODkatHZ8t+9kIGexpQeq6+ii3/gpI9rc172Es7HgUJnfHi:wkaj8CkIGkpQeqaiPL+16X7vJnK

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      63934ae4c23ad5c1c1d9c2343dfc3b86

    • Size

      112KB

    • MD5

      63934ae4c23ad5c1c1d9c2343dfc3b86

    • SHA1

      259b53bc64607d6fe2e1aae7e8d5385bf794599e

    • SHA256

      98c0d0317cb20daab2ceb8167c6e95eed9b332f1423c79a06d57bca9abb339de

    • SHA512

      577dd4cf4aa1705648ce12f6762521a0baafb01965b2165995d2c721e8989d502b5da24401253e83bee36196ef232d42bb638149bf86d9dbf1b6a672a7a130cf

    • SSDEEP

      3072:ODkatHZ8t+9kIGexpQeq6+ii3/gpI9rc172Es7HgUJnfHi:wkaj8CkIGkpQeqaiPL+16X7vJnK

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks