General

  • Target

    adc83546918d6d734e1cdba98ff333b3cfac455e3613971b5ffca815c29776a2

  • Size

    268KB

  • Sample

    240423-e4k14ada8z

  • MD5

    5c3d7aa2358ae37aee12d7a5b689238a

  • SHA1

    e77605176d9dec8c78e02a5144884608566e4268

  • SHA256

    adc83546918d6d734e1cdba98ff333b3cfac455e3613971b5ffca815c29776a2

  • SHA512

    867af85b87378c270f47d23771cdf8f9d8f1729e5f5e8f4a1a219fcf07e7d2cc2f47e2b1b7ed37ed2a589168d35ef9a9d54c75f7d59d525ae7204f10c522c83a

  • SSDEEP

    6144:B2Rnh5EsIm2EJ7RNYQRcyXthY09inGogju:Beh5EsIYJdNPd9G090Niu

Malware Config

Targets

    • Target

      adc83546918d6d734e1cdba98ff333b3cfac455e3613971b5ffca815c29776a2

    • Size

      268KB

    • MD5

      5c3d7aa2358ae37aee12d7a5b689238a

    • SHA1

      e77605176d9dec8c78e02a5144884608566e4268

    • SHA256

      adc83546918d6d734e1cdba98ff333b3cfac455e3613971b5ffca815c29776a2

    • SHA512

      867af85b87378c270f47d23771cdf8f9d8f1729e5f5e8f4a1a219fcf07e7d2cc2f47e2b1b7ed37ed2a589168d35ef9a9d54c75f7d59d525ae7204f10c522c83a

    • SSDEEP

      6144:B2Rnh5EsIm2EJ7RNYQRcyXthY09inGogju:Beh5EsIYJdNPd9G090Niu

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks