Overview

overview

10

Static

static

3

3a0732ee74...e1.exe

windows7-x64

10

3a0732ee74...e1.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3a0732ee740b943c45268759289182c690e05454c7f8e6b3c14cbb5fb07b91e1

  • Size

    2.5MB

  • Sample

    240312-x8zddshe31

  • MD5

    250c479b1bcfdb2e69335d80ca5e1d75

  • SHA1

    1dc2b64daf1f2b9406a17bc406a66a15d7470451

  • SHA256

    3a0732ee740b943c45268759289182c690e05454c7f8e6b3c14cbb5fb07b91e1

  • SHA512

    e91284f6c2068cd76e38ee795d2a9d674ba54a356d7a41524df254bd9796e6e7063d71df9893223d8b46bf23829903292111f320c1602ece0f96084f242e6dc5

  • SSDEEP

    49152:vi3ve+IcWDirBj4GUH/jbgFV1fuZpN67UULVecJRgyOUKhReyfjfqv2ci3:a3vcc7dQfjbgFV1gpg79eCh7LyDqXi3

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      3a0732ee740b943c45268759289182c690e05454c7f8e6b3c14cbb5fb07b91e1

    • Size

      2.5MB

    • MD5

      250c479b1bcfdb2e69335d80ca5e1d75

    • SHA1

      1dc2b64daf1f2b9406a17bc406a66a15d7470451

    • SHA256

      3a0732ee740b943c45268759289182c690e05454c7f8e6b3c14cbb5fb07b91e1

    • SHA512

      e91284f6c2068cd76e38ee795d2a9d674ba54a356d7a41524df254bd9796e6e7063d71df9893223d8b46bf23829903292111f320c1602ece0f96084f242e6dc5

    • SSDEEP

      49152:vi3ve+IcWDirBj4GUH/jbgFV1fuZpN67UULVecJRgyOUKhReyfjfqv2ci3:a3vcc7dQfjbgFV1gpg79eCh7LyDqXi3

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks