Overview

overview

10

Static

static

10

bc374be2cb...87.exe

windows7-x64

10

bc374be2cb...87.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc374be2cb5c6389de587dfb96331487

  • Size

    130KB

  • Sample

    240309-tegppscd4v

  • MD5

    bc374be2cb5c6389de587dfb96331487

  • SHA1

    020e504ebdf70df5b3979d97f6367dbef59f87f0

  • SHA256

    46f6dc220d1b8c520f298bbdfd91e0f38fc23e7fd55c711fb0bf616acec450d5

  • SHA512

    9724fccf9b96eeb4b5c2187cb91555dc1d259a438eabefec686d402ecdaabfdb7c21c54055cfb6fb60ef11689478d82a45e051527989be78281ced2288e9b690

  • SSDEEP

    3072:4Z8r87ei5tAEOZzMoLJbJdQeU79BknqA1kxb2jz:4Z8gtjnORVJOvPEqAaB2v

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      bc374be2cb5c6389de587dfb96331487

    • Size

      130KB

    • MD5

      bc374be2cb5c6389de587dfb96331487

    • SHA1

      020e504ebdf70df5b3979d97f6367dbef59f87f0

    • SHA256

      46f6dc220d1b8c520f298bbdfd91e0f38fc23e7fd55c711fb0bf616acec450d5

    • SHA512

      9724fccf9b96eeb4b5c2187cb91555dc1d259a438eabefec686d402ecdaabfdb7c21c54055cfb6fb60ef11689478d82a45e051527989be78281ced2288e9b690

    • SSDEEP

      3072:4Z8r87ei5tAEOZzMoLJbJdQeU79BknqA1kxb2jz:4Z8gtjnORVJOvPEqAaB2v

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks