Overview

overview

10

Static

static

10

c9d7315180...d9.exe

windows7-x64

10

c9d7315180...d9.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    c9d7315180eddce5f8766931d3d253d9

  • Size

    260KB

  • Sample

    240314-2xp3sshg6s

  • MD5

    c9d7315180eddce5f8766931d3d253d9

  • SHA1

    2882ac46abacea7a10f25155d20eb2a5c75aeb17

  • SHA256

    d170cc1da0025093edda8273ad24ab525fd5e8a050327e42e438c0c6337e47f8

  • SHA512

    58cbd84f3ad71db150f5f0f78651a233e4f38b365baafc7b7ad0f4856846688ea9a83ae553693dde2639216cc73c48711399dd9d93a4a5d8080f83a48248eb80

  • SSDEEP

    6144:n2Rnh5EsIm2E47RNYQRsyXStY09inGogj1Y6:neh5EsIY4dNPtiy090Ni26

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      c9d7315180eddce5f8766931d3d253d9

    • Size

      260KB

    • MD5

      c9d7315180eddce5f8766931d3d253d9

    • SHA1

      2882ac46abacea7a10f25155d20eb2a5c75aeb17

    • SHA256

      d170cc1da0025093edda8273ad24ab525fd5e8a050327e42e438c0c6337e47f8

    • SHA512

      58cbd84f3ad71db150f5f0f78651a233e4f38b365baafc7b7ad0f4856846688ea9a83ae553693dde2639216cc73c48711399dd9d93a4a5d8080f83a48248eb80

    • SSDEEP

      6144:n2Rnh5EsIm2E47RNYQRsyXStY09inGogj1Y6:neh5EsIY4dNPtiy090Ni26

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks