Overview

overview

10

Static

static

3

ab180546c3...ac.exe

windows7-x64

10

ab180546c3...ac.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ab180546c31605b18efd785ed1b5d178a4dcaf1555ed5777afb0383bb488eeac

  • Size

    1.2MB

  • Sample

    240309-jw8veaeh6x

  • MD5

    1e41a9f4bd6d649c6eae25a4e9839fa4

  • SHA1

    93d400f549579b23f06cd4b18b41cec985f64142

  • SHA256

    ab180546c31605b18efd785ed1b5d178a4dcaf1555ed5777afb0383bb488eeac

  • SHA512

    eab96b6fe8b458fe739cd1ff31f69db1eaa6e6954d1fd8bdeedd3a82e6f05c1304a0d2ae13df465ba413914576fc045ee08c160905230e195dd14f527574c390

  • SSDEEP

    24576:WYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnwyzL:WYREXSVMDi3D

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      ab180546c31605b18efd785ed1b5d178a4dcaf1555ed5777afb0383bb488eeac

    • Size

      1.2MB

    • MD5

      1e41a9f4bd6d649c6eae25a4e9839fa4

    • SHA1

      93d400f549579b23f06cd4b18b41cec985f64142

    • SHA256

      ab180546c31605b18efd785ed1b5d178a4dcaf1555ed5777afb0383bb488eeac

    • SHA512

      eab96b6fe8b458fe739cd1ff31f69db1eaa6e6954d1fd8bdeedd3a82e6f05c1304a0d2ae13df465ba413914576fc045ee08c160905230e195dd14f527574c390

    • SSDEEP

      24576:WYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnwyzL:WYREXSVMDi3D

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks