gh0strat | P2P-Worm[.]Win32[.]Palevo[.]cqmm-94ad2b6deba07d003e6567c91b4fccabbb95987f70fde2fc2e0c2025cb724ae6

General

Target

P2P-Worm.Win32.Palevo.cqmm-94ad2b6deba07d003e6567c91b4fccabbb95987f70fde2fc2e0c2025cb724ae6
Size

304KB
MD5

1d056c877ffb76622b68becff16e56cc
SHA1

071c7c71b7959fe087401779208b43b0fefcece0
SHA256

94ad2b6deba07d003e6567c91b4fccabbb95987f70fde2fc2e0c2025cb724ae6
SHA512

747f7128ce61db8dfe36580009969de7f3bc4631416a2658e6f27d243f50e88424c03a3d65f99922e2ed8e99aacf461592b3eda034d26c6404490d0b0f0f50f4
SSDEEP

6144:JiwtiWB0mL7tHJ5Jp34O5O4G7v4G7AWFb:8qB0mdHrJNtuJAi

Score

10^/10

gh0strat

Detects executables embedding registry key / value combination manipulating RDP / Terminal Services 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP

Detects file containing reversed ASEP Autorun registry keys 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_ASEP_REG_Reverse

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
P2P-Worm.Win32.Palevo.cqmm-94ad2b6deba07d003e6567c91b4fccabbb95987f70fde2fc2e0c2025cb724ae6