Overview

overview

10

Static

static

1

68265c93b1...d0.exe

windows7-x64

10

68265c93b1...d0.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    68265c93b1f79558398669e8949b47d0

  • Size

    301KB

  • Sample

    240119-ven98aaga6

  • MD5

    68265c93b1f79558398669e8949b47d0

  • SHA1

    3dada32df441e5a4995b12fdf549b363c8eefddc

  • SHA256

    777734e0ca143bb244e89619d24447d5d224e9e7f34e2bf15404499279c9a4ee

  • SHA512

    7630e261ebcf5573b17bca49e19eb66f28ac7a9a0b901422632538b3d91eb632f7749a9d34eb05d6b09af8f50b5f70442ba64b47ee71e0a711fa266a21e31f25

  • SSDEEP

    6144:ndfgeC3QSE7MhZs2GJmT0GHNsoozQ9bd2wFpgSOhCrdUvMyV:dfgeC3xEI3sUNHNk+2wFySOhCrmvMyV

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      68265c93b1f79558398669e8949b47d0

    • Size

      301KB

    • MD5

      68265c93b1f79558398669e8949b47d0

    • SHA1

      3dada32df441e5a4995b12fdf549b363c8eefddc

    • SHA256

      777734e0ca143bb244e89619d24447d5d224e9e7f34e2bf15404499279c9a4ee

    • SHA512

      7630e261ebcf5573b17bca49e19eb66f28ac7a9a0b901422632538b3d91eb632f7749a9d34eb05d6b09af8f50b5f70442ba64b47ee71e0a711fa266a21e31f25

    • SSDEEP

      6144:ndfgeC3QSE7MhZs2GJmT0GHNsoozQ9bd2wFpgSOhCrdUvMyV:dfgeC3xEI3sUNHNk+2wFySOhCrmvMyV

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Drops file in Drivers directory

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks