Overview

overview

10

Static

static

10

67db9e0ccd...e7.exe

windows7-x64

10

67db9e0ccd...e7.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    67db9e0ccd41c349aae6b462c7ade0e7

  • Size

    196KB

  • Sample

    240119-rvmjsagda4

  • MD5

    67db9e0ccd41c349aae6b462c7ade0e7

  • SHA1

    6117b1135e58db090ff9b7040d54345db685af5e

  • SHA256

    3e28e830b95fab08e87133f3eb55ab001255c70735ae0afdd29baa195dd0f824

  • SHA512

    3bbdee2c86fd5d60607244b0fe47556e6708c810c118e312c451680701237ea1dcb17f30d67d5dda237459dce246b9580d8fa359466007223e7ecb346818af84

  • SSDEEP

    6144:6sIt6nW8Q/BTyPRqyhYPbHcTBlhHrqndnkv0:39W8xJq8YPbHcT3R

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      67db9e0ccd41c349aae6b462c7ade0e7

    • Size

      196KB

    • MD5

      67db9e0ccd41c349aae6b462c7ade0e7

    • SHA1

      6117b1135e58db090ff9b7040d54345db685af5e

    • SHA256

      3e28e830b95fab08e87133f3eb55ab001255c70735ae0afdd29baa195dd0f824

    • SHA512

      3bbdee2c86fd5d60607244b0fe47556e6708c810c118e312c451680701237ea1dcb17f30d67d5dda237459dce246b9580d8fa359466007223e7ecb346818af84

    • SSDEEP

      6144:6sIt6nW8Q/BTyPRqyhYPbHcTBlhHrqndnkv0:39W8xJq8YPbHcT3R

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks