Extracted

• • Target

    8c0f2e958f55223c22e34d27c634e5e6832015d7261e04ac343a46a34840d798

  • Size

    396KB

  • MD5

    7e55fa38174e4f18522aa08011c65783

  • SHA1

    a945e1df752a25725798d42b55ef44c36b6d9cc2

  • SHA256

    8c0f2e958f55223c22e34d27c634e5e6832015d7261e04ac343a46a34840d798

  • SHA512

    5fee0fd150c176649805e53f42a4a3b472604c950d285ba00925bca6ca859ea034c6ebf2dfb66bc7d8c5cf4d8c9839cb185ba7dfb16008878400da8793fe6bc0

  • SSDEEP

    3072:q7K/yLrQbWaR5Qax8cytUTlZiftPRAqE3PC8tSoUSZQWKMK8iA:qqyLEbWaR5Ccy4ifXc3PXS/SZjK18iA

  Score

  10^/10

  gh0stratratpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2