Overview

overview

10

Static

static

1

a15f9efa36...8b.exe

windows7-x64

10

a15f9efa36...8b.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    a15f9efa3687b7ddca05a74959a81b8b

  • Size

    611KB

  • Sample

    240224-j2lxtseb42

  • MD5

    a15f9efa3687b7ddca05a74959a81b8b

  • SHA1

    883a3797bc56355bd357afb7c4a484adc4c51012

  • SHA256

    3bfdc2df5a834dfa17eadeb3dc530cdfd3c38d0d06b692e6f1aa257dc174d7e3

  • SHA512

    71019fc251c10546168996eb364abccc2a56e794409d6d4e85403ca3b3686bcf795c9658f5f7f1a7273e7df35428eca56b2e07b35ab8a78640d2a8dc049b6940

  • SSDEEP

    12288:OKVu7nkEp3gos8uXY4cO/gqhd+3C5+qQUjJUU4QdxIYDdtWnI+NKnw/L1:Oou7nkEp3W8AD/Dhd+y4lqJ8QdCYDoD5

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      a15f9efa3687b7ddca05a74959a81b8b

    • Size

      611KB

    • MD5

      a15f9efa3687b7ddca05a74959a81b8b

    • SHA1

      883a3797bc56355bd357afb7c4a484adc4c51012

    • SHA256

      3bfdc2df5a834dfa17eadeb3dc530cdfd3c38d0d06b692e6f1aa257dc174d7e3

    • SHA512

      71019fc251c10546168996eb364abccc2a56e794409d6d4e85403ca3b3686bcf795c9658f5f7f1a7273e7df35428eca56b2e07b35ab8a78640d2a8dc049b6940

    • SSDEEP

      12288:OKVu7nkEp3gos8uXY4cO/gqhd+3C5+qQUjJUU4QdxIYDdtWnI+NKnw/L1:Oou7nkEp3W8AD/Dhd+y4lqJ8QdCYDoD5

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks