General
-
Target
60d0d9690d8d28c9773f11ef5d7d017af4432a64bcfc74ef6a86720c242c0a06
-
Size
80KB
-
Sample
240419-v8zytaah87
-
MD5
31a6f27cff3d94e54bffb71d54099f5e
-
SHA1
0dc8447170241d58ab82df120d853ae610a84a89
-
SHA256
60d0d9690d8d28c9773f11ef5d7d017af4432a64bcfc74ef6a86720c242c0a06
-
SHA512
95c8ef6cf3748e75c6c2eb315e61e8cb8f6c7005f7b844c1c9fd6b61a07e13c1e552108e89183225c1a5cc632f7b5d54ff8b98e4deb924574145a5805e77f4c8
-
SSDEEP
1536:799vF6k6Bt/20G03pTZxDjVV0w47EiA5qD8YlPDHc5qFD7kqPlUnpUmqqnN:7fv4k6BNLzTxDLI7Ei4qD88rYO/PlUnB
Behavioral task
behavioral1
Sample
cf8ecb6dbe903a56679d0adaaf5588a58c0f5ac1999fe187189e4d04c916015f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cf8ecb6dbe903a56679d0adaaf5588a58c0f5ac1999fe187189e4d04c916015f.exe
Resource
win10v2004-20240412-en
Malware Config
Targets
-
-
Target
cf8ecb6dbe903a56679d0adaaf5588a58c0f5ac1999fe187189e4d04c916015f.exe
-
Size
83KB
-
MD5
50d4a04522a21e540cbf368f49432778
-
SHA1
55a4445ad3213788803c3fcd5adce45137b3a155
-
SHA256
cf8ecb6dbe903a56679d0adaaf5588a58c0f5ac1999fe187189e4d04c916015f
-
SHA512
08ebf0b333ad8dc8951347437bc2f1b7647763aaf4dce13d8ab1db14bc66539fd58ba263572b57e07c24b4470b3100585e881a843d663dff1eb7e5201f4e4bae
-
SSDEEP
1536:5M8/+vtlxZTLY9qgJodItYg2pyb4WR927FSijIVTUKvScg7DSf:T+rx98qgJoItKfqYpxsYcg7DK
Score10/10-
Gh0st RAT payload
-
Sets DLL path for service in the registry
-
Deletes itself
-
Loads dropped DLL
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-