Overview

overview

10

Static

static

10

b3d65737ac...3c.exe

windows7-x64

10

b3d65737ac...3c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b3d65737accd218894a2ce5441baaccd24cb072c646f15891379c585a0e7333c

  • Size

    260KB

  • Sample

    240418-rnqymagf21

  • MD5

    34da5b125a45859931ee03df7a546f11

  • SHA1

    0757440d9b4aa11eb639e03a4a5dc56c10acee33

  • SHA256

    b3d65737accd218894a2ce5441baaccd24cb072c646f15891379c585a0e7333c

  • SHA512

    917d4b56b68623dcbfde0a79eb2840dc47ec184e20ddb3504df94b5e2f67de31ad02f0766dcf45c9ebf9afa81b289e6c10a9560963ac4765bc84ebb934198fec

  • SSDEEP

    6144:X2Rnh5EsIm2E47RNYQRsyXs0Y09inGogj1YR:Xeh5EsIY4dNPtcb090Ni2R

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      b3d65737accd218894a2ce5441baaccd24cb072c646f15891379c585a0e7333c

    • Size

      260KB

    • MD5

      34da5b125a45859931ee03df7a546f11

    • SHA1

      0757440d9b4aa11eb639e03a4a5dc56c10acee33

    • SHA256

      b3d65737accd218894a2ce5441baaccd24cb072c646f15891379c585a0e7333c

    • SHA512

      917d4b56b68623dcbfde0a79eb2840dc47ec184e20ddb3504df94b5e2f67de31ad02f0766dcf45c9ebf9afa81b289e6c10a9560963ac4765bc84ebb934198fec

    • SSDEEP

      6144:X2Rnh5EsIm2E47RNYQRsyXs0Y09inGogj1YR:Xeh5EsIY4dNPtcb090Ni2R

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks