General
-
Target
9a2c9fd6fc99db356c821f4d4c273779f5f269cc6622e4169731860dac6d764e
-
Size
133KB
-
Sample
240301-3vxwasfb5s
-
MD5
cc161576227291fe78a973024cd475da
-
SHA1
f15bd69fa1d120374757f3b0e0beb54de01663d5
-
SHA256
9a2c9fd6fc99db356c821f4d4c273779f5f269cc6622e4169731860dac6d764e
-
SHA512
17de35956dcc67a0d4a9fbd4ab85b34ae15e48be7e5a539656c9c3af0af8fcdb75b18356959336532c25461a8924fcdb0d26437d7857dbce45a176d8a8628839
-
SSDEEP
1536:YqEA70HzLJksPEOajozLElnqiO2foSght:YXTLJkQ7zAV33At
Behavioral task
behavioral1
Sample
9a2c9fd6fc99db356c821f4d4c273779f5f269cc6622e4169731860dac6d764e.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9a2c9fd6fc99db356c821f4d4c273779f5f269cc6622e4169731860dac6d764e.exe
Resource
win10v2004-20240226-en
Malware Config
Extracted
gh0strat
sky.hobuff.info
Targets
-
-
Target
9a2c9fd6fc99db356c821f4d4c273779f5f269cc6622e4169731860dac6d764e
-
Size
133KB
-
MD5
cc161576227291fe78a973024cd475da
-
SHA1
f15bd69fa1d120374757f3b0e0beb54de01663d5
-
SHA256
9a2c9fd6fc99db356c821f4d4c273779f5f269cc6622e4169731860dac6d764e
-
SHA512
17de35956dcc67a0d4a9fbd4ab85b34ae15e48be7e5a539656c9c3af0af8fcdb75b18356959336532c25461a8924fcdb0d26437d7857dbce45a176d8a8628839
-
SSDEEP
1536:YqEA70HzLJksPEOajozLElnqiO2foSght:YXTLJkQ7zAV33At
Score10/10-
Gh0st RAT payload
-
Sets DLL path for service in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Creates a Windows Service
-
Drops file in System32 directory
-