Extracted

• • Target

    286ed039d9dcbf14a06a102831c163748db1bfaef47dc51a4114cd5a076cbc9d

  • Size

    114KB

  • MD5

    ca4bb52547f96a438f4ac818b49b4390

  • SHA1

    345541c809c323974873c5186db4f9b6e1af28b4

  • SHA256

    286ed039d9dcbf14a06a102831c163748db1bfaef47dc51a4114cd5a076cbc9d

  • SHA512

    77249debd1328f5a7f02017c99940cdc802045bf39cd149b034c02aad4084a828d3ed9b398ccfd832a6bddb0759620f960f6e4c22e1c9617d4e9c9a3d062e269

  • SSDEEP

    3072:pNDmF0ETdzsCeymmiat8f44IwMIGakllF9UIi/N3kmdj:pNDmeWhsVlM8fMwMVUQmd

  Score

  10^/10

  gh0stratratupxpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2