gh0strat | 3fd2c7404c071dc749f08fea9662971f5f2c13b7cda50b2183bfeff924a7fd3e

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
23/04/2024, 04:28

Target
3fd2c7404c071dc749f08fea9662971f5f2c13b7cda50b2183bfeff924a7fd3e.exe
Size 60KB
Sample240423-e3w2zada52
SHA256 3fd2c7404c071dc749f08fea9662971f5f2c13b7cda50b2183bfeff924a7fd3e
MD5 5f353bc8d0bb5623f60e4ca92fee6b9a
SHA1 96af2c7dc0677e43e94faaedec0bec95105fe993
SHA512 ee0178c14ad63dd007208043141ee3cae8166e1d9d56d0b3e43991485c2045ba698536a0bc0a91b01023673f678b6b1a79fec0c77e53e97fa942a6fb9672fb9c
SSDEEP 384:uCPRY4e8ofpHJDJX85f1ABGVWn8oOXaSNnDgWaC1T1jp7sxNd4D5tdLYi61b3w7s:5JXhyRJ56T8n8oRScE4Nd4tYb3r
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat rat

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/memory/876-0-0x0000000010000000-0x0000000010018000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
876	3fd2c7404c071dc749f08fea9662971f5f2c13b7cda50b2183bfeff924a7fd3e.exe
876	3fd2c7404c071dc749f08fea9662971f5f2c13b7cda50b2183bfeff924a7fd3e.exe

C:\Users\Admin\AppData\Local\Temp\3fd2c7404c071dc749f08fea9662971f5f2c13b7cda50b2183bfeff924a7fd3e.exe
"C:\Users\Admin\AppData\Local\Temp\3fd2c7404c071dc749f08fea9662971f5f2c13b7cda50b2183bfeff924a7fd3e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:876

memory/876-0-0x0000000010000000-0x0000000010018000-memory.dmp

Download