Overview

overview

10

Static

static

10

d2ffa748db...dd.dll

windows7-x64

10

d2ffa748db...dd.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2ffa748dbec79695cb311d6c3fadf3182972db352d6c4d2ec1e036f726b3bdd

  • Size

    148KB

  • Sample

    240225-hcza7aef7x

  • MD5

    f46f7f560dca4ccc2a54dba09a5f1066

  • SHA1

    47812eaf11cd28352d9100b5a5a3491aad35c8b4

  • SHA256

    d2ffa748dbec79695cb311d6c3fadf3182972db352d6c4d2ec1e036f726b3bdd

  • SHA512

    51b03eb00e188fdd85d8f0a5ddd6c2743487d7d14fb538b9eff78f798017e646ac450dc679c25fbfba9c3012a018389e1b861350e3d29ca33d6b6c93b14062ed

  • SSDEEP

    3072:ohPm77B1ZDwB76mVlZmFRqGd4PwcwMG5vY:kWd1ZDg7HqRqGywR5vY

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      d2ffa748dbec79695cb311d6c3fadf3182972db352d6c4d2ec1e036f726b3bdd

    • Size

      148KB

    • MD5

      f46f7f560dca4ccc2a54dba09a5f1066

    • SHA1

      47812eaf11cd28352d9100b5a5a3491aad35c8b4

    • SHA256

      d2ffa748dbec79695cb311d6c3fadf3182972db352d6c4d2ec1e036f726b3bdd

    • SHA512

      51b03eb00e188fdd85d8f0a5ddd6c2743487d7d14fb538b9eff78f798017e646ac450dc679c25fbfba9c3012a018389e1b861350e3d29ca33d6b6c93b14062ed

    • SSDEEP

      3072:ohPm77B1ZDwB76mVlZmFRqGd4PwcwMG5vY:kWd1ZDg7HqRqGywR5vY

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks