Extracted

• • Target

    909f062a9bfaccdb28497f626a03dfd6dd3b108b6f42736e11de6dcb073213f1

  • Size

    1.3MB

  • MD5

    2de4d3fe5d3e90fe716a4d56681d3321

  • SHA1

    04a6198b735449d00f903a1206057f8e206221e0

  • SHA256

    909f062a9bfaccdb28497f626a03dfd6dd3b108b6f42736e11de6dcb073213f1

  • SHA512

    313d18f89d1580a33feb705fcf4ccfe08817e9155dc8d5299cfbb93a1d2dbffb92a82f74a653e24298c9b62e6875ce56c6e0d1d9571562a61944330460fc9cce

  • SSDEEP

    24576:6YFbkIsaPiXSVnC7Yp9zkNmZG8RRlngyz9TbCyIeVznAX/roDs3X:6YREXSVMDi3lT+ybnO

  Score

  10^/10

  gh0stratpersistencerat

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Sets DLL path for service in the registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2