Extracted

• • Target

    2116f6acdd3598562ab4c05e6bc393caf9799ae2d48d1403742c7a5e7adaf8cc

  • Size

    1.1MB

  • MD5

    b4bb3f58cf1310b9dd44a2d513340fd6

  • SHA1

    26e6e13b03990317012d912d358695d4e55dee3e

  • SHA256

    2116f6acdd3598562ab4c05e6bc393caf9799ae2d48d1403742c7a5e7adaf8cc

  • SHA512

    768fc88a5de2e88a88ac5f3e2f8172219001930f147fbb8f72230a1d0b74c877d77ea1833f9daf12c018d1d72702dca72e8ec66db5dff6ef0b656c3dd682f181

  • SSDEEP

    3072:ZyIpG2/iDbYpEXcFHUZUMgJUYF+JddZ6sReR8iVt:oIposicF0Z9gJh+bdEH8iVt

  Score

  10^/10

  gh0stratratupxpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2