General
-
Target
860bdd26a43968b1d1318469e3c6d3d9f21f58c6e6f185dedfb5b97453e5d54b
-
Size
387KB
-
Sample
240419-bpl33ade41
-
MD5
0bd67a9c634dc4f5587b943881532efb
-
SHA1
3df289effe66bffc0f9a478f7df34c52b1589ffd
-
SHA256
860bdd26a43968b1d1318469e3c6d3d9f21f58c6e6f185dedfb5b97453e5d54b
-
SHA512
046212be2bd7ea3a9d41a41fffbccc1cf681e2b45cfedc5feed808acea75ca031d7ef746063569de23ee49c2d6e375ee5d2fff3439f62f0950ea71e6f107b7f6
-
SSDEEP
6144:ASutg448cyV/q/T9yl/128y05cpn7zMpvF3CuFxZrPgfsxRAjXxbClj22:NutTZV/qb9ylN28aE2GThX8xb0
Static task
static1
Behavioral task
behavioral1
Sample
860bdd26a43968b1d1318469e3c6d3d9f21f58c6e6f185dedfb5b97453e5d54b.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
860bdd26a43968b1d1318469e3c6d3d9f21f58c6e6f185dedfb5b97453e5d54b
-
Size
387KB
-
MD5
0bd67a9c634dc4f5587b943881532efb
-
SHA1
3df289effe66bffc0f9a478f7df34c52b1589ffd
-
SHA256
860bdd26a43968b1d1318469e3c6d3d9f21f58c6e6f185dedfb5b97453e5d54b
-
SHA512
046212be2bd7ea3a9d41a41fffbccc1cf681e2b45cfedc5feed808acea75ca031d7ef746063569de23ee49c2d6e375ee5d2fff3439f62f0950ea71e6f107b7f6
-
SSDEEP
6144:ASutg448cyV/q/T9yl/128y05cpn7zMpvF3CuFxZrPgfsxRAjXxbClj22:NutTZV/qb9ylN28aE2GThX8xb0
-
Gh0st RAT payload
-
Drops file in Drivers directory
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-