Overview

overview

10

Static

static

10

999d65e099...28.exe

windows7-x64

10

999d65e099...28.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    999d65e0997ad86772be494b5dd01828

  • Size

    125KB

  • Sample

    240213-rfb5hach79

  • MD5

    999d65e0997ad86772be494b5dd01828

  • SHA1

    442ea52b67d8f01f32770906831836eeb0cc590a

  • SHA256

    29c9c991638bfa1db994bfd1e8cda0557da523851a377aeecdfee110ed98a7f6

  • SHA512

    42ba68194825430662eb23de95a5ddfe8e44bd2789b808041881b8b69af1d022f8a1852c81fc27d0adeb307a8be544610b73f2fe5cea51fabf4a7f7aa63e39f7

  • SSDEEP

    3072:zS3i7bVEnOQ5UP6hKRXuS6S9L3e2ta2OMdj3Kx8oK:zSKVEnOQ5UyhZK973aodj6y

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      999d65e0997ad86772be494b5dd01828

    • Size

      125KB

    • MD5

      999d65e0997ad86772be494b5dd01828

    • SHA1

      442ea52b67d8f01f32770906831836eeb0cc590a

    • SHA256

      29c9c991638bfa1db994bfd1e8cda0557da523851a377aeecdfee110ed98a7f6

    • SHA512

      42ba68194825430662eb23de95a5ddfe8e44bd2789b808041881b8b69af1d022f8a1852c81fc27d0adeb307a8be544610b73f2fe5cea51fabf4a7f7aa63e39f7

    • SSDEEP

      3072:zS3i7bVEnOQ5UP6hKRXuS6S9L3e2ta2OMdj3Kx8oK:zSKVEnOQ5UyhZK973aodj6y

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks