General
-
Target
2113d0c065cf3dd437016384da1075f185771d80a805e32c160d38089cc15763
-
Size
1.4MB
-
Sample
240320-hrrjwsbg7z
-
MD5
8e9f114d683c28148dde9580673ab4b5
-
SHA1
b53efaa6b99d1c6679f655403e7710b99c1fafd5
-
SHA256
2113d0c065cf3dd437016384da1075f185771d80a805e32c160d38089cc15763
-
SHA512
036115d133d038e96b51199727a1ebd151e08b124e696e6ccd487b4acfd84999eec501b5e4caf0f7524d43e775c102a9bf7cef0f9ab6e687b4a000e356cc2ce4
-
SSDEEP
24576:GR7dAdoCot4bVU5VgeufGl1ygiZSP490QSn6aRmBMLyZY54ej2pLWyHm3UEbu:GR6iCNU1Yv3ZS3/RtLcY2ejxyG3UW
Static task
static1
Behavioral task
behavioral1
Sample
2113d0c065cf3dd437016384da1075f185771d80a805e32c160d38089cc15763.exe
Resource
win7-20240319-en
Malware Config
Targets
-
-
Target
2113d0c065cf3dd437016384da1075f185771d80a805e32c160d38089cc15763
-
Size
1.4MB
-
MD5
8e9f114d683c28148dde9580673ab4b5
-
SHA1
b53efaa6b99d1c6679f655403e7710b99c1fafd5
-
SHA256
2113d0c065cf3dd437016384da1075f185771d80a805e32c160d38089cc15763
-
SHA512
036115d133d038e96b51199727a1ebd151e08b124e696e6ccd487b4acfd84999eec501b5e4caf0f7524d43e775c102a9bf7cef0f9ab6e687b4a000e356cc2ce4
-
SSDEEP
24576:GR7dAdoCot4bVU5VgeufGl1ygiZSP490QSn6aRmBMLyZY54ej2pLWyHm3UEbu:GR6iCNU1Yv3ZS3/RtLcY2ejxyG3UW
-
Gh0st RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-