Extracted

• • Target

    0813ab2ef2cf5c29a682fe5e517d8239bf6d2a7e69c10767179a31c870992513

  • Size

    1.0MB

  • MD5

    e5d0430246058fca3e743ea35b407cb5

  • SHA1

    ecfc4b65b32bcedb9afae29cdff3440be66e0a0d

  • SHA256

    0813ab2ef2cf5c29a682fe5e517d8239bf6d2a7e69c10767179a31c870992513

  • SHA512

    340d66469631a144557ec2a95b69c5832552aa35854928ee8cd87086bfa92987f0ded6da2f1be38ec47a7b389d623773459069b773d7cf1536338fc2c0eab2ba

  • SSDEEP

    24576:d25QCM0G4WzlCGtZGq91Ax0qY++5FG1m5g/2Pxs:d25BK5CGxy0BD5FKG4h

  Score

  10^/10

  gh0stratrat

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2