General

  • Target

    93c75fff7e530e1f6d0c978dda74c2ab7014c278d5e065bd98225ba76466a851.exe

  • Size

    108KB

  • Sample

    240126-rx5hdafgg7

  • MD5

    0dced16e67bd5851534394c976af3251

  • SHA1

    d7441b25a4d5a8c68ea83d327fbce8a93b928fda

  • SHA256

    38f9bb7bcde6668456ff8a21c67cc062b839677875cb27f6f9e52034b6945c2d

  • SHA512

    86e58e8ca2e6052e21f6e5062a44c054f1db08ea547cddf42ab107f0613a51e65e544099b25ad977101beeba9a999e05586cdde60e8017bb9aa4499cb392adb0

  • SSDEEP

    1536:lqEA70HzLJksPEOajozLElnqiO2vdgPb:lXTLJkQ7zAV3ePb

Malware Config

Extracted

Family

gh0strat

C2

sky.hobuff.info

Targets

    • Target

      93c75fff7e530e1f6d0c978dda74c2ab7014c278d5e065bd98225ba76466a851.exe

    • Size

      108KB

    • MD5

      0dced16e67bd5851534394c976af3251

    • SHA1

      d7441b25a4d5a8c68ea83d327fbce8a93b928fda

    • SHA256

      38f9bb7bcde6668456ff8a21c67cc062b839677875cb27f6f9e52034b6945c2d

    • SHA512

      86e58e8ca2e6052e21f6e5062a44c054f1db08ea547cddf42ab107f0613a51e65e544099b25ad977101beeba9a999e05586cdde60e8017bb9aa4499cb392adb0

    • SSDEEP

      1536:lqEA70HzLJksPEOajozLElnqiO2vdgPb:lXTLJkQ7zAV3ePb

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • RunningRat

      RunningRat is a remote access trojan first seen in 2018.

    • Sets DLL path for service in the registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Creates a Windows Service

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.