Extracted

• • Target

    829567da24356078abb1ff8beb1b53e460cb4f1d67fab2b1d605912b8b7c438c.exe

  • Size

    108KB

  • MD5

    98cbe8668a8e12416cb4dd7041ae5a1f

  • SHA1

    2bfea256de980a9faeada753725b9bcb368efcd8

  • SHA256

    e1a5558088d6f241331f2f443e098f8293c14843d580a1e0971dbde7ff2e6c6c

  • SHA512

    54413adf88c300d372f3cfe6c057f204d2a70a714ec84dbe566e2c32475774518c89a584954da6a55e338d0b0e5338456b969f6b472bfab310c44bac32f64d77

  • SSDEEP

    1536:lqEA70HzLJksPEOajozLElnqiO2+dgPb:lXTLJkQ7zAV3XPb

  Score

  10^/10

  gh0stratrunningratpersistencerat

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • RunningRat

    RunningRat is a remote access trojan first seen in 2018.

    ratrunningrat

  • Sets DLL path for service in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2