Extracted

• • Target

    04873d414d4cd4d41ae4d3dff098a2b4260be73d92a7efb139d1677b0cb6e623

  • Size

    684KB

  • MD5

    1bd41a4925226862a9dd18abce9515d5

  • SHA1

    cdcbdb66ca67c511774c4ffa06d7e954e2b25136

  • SHA256

    04873d414d4cd4d41ae4d3dff098a2b4260be73d92a7efb139d1677b0cb6e623

  • SHA512

    39349596911102ad081ab91230ed0af2d69ccb9887a47bdd9c869cc13858aae8c7d523b7ef4cd7988cbd4dafd2edc576a4ebc9b4416ff57a0e6849d847a0395d

  • SSDEEP

    3072:ScK/yLrQbWaR5Qax8c/YtZGx0gLY9eHVU2NYYKtjTtnbaUllllllllllllllpsx9:SXyLEbWaR5CcSAYYm2+tbLy

  Score

  10^/10

  gh0stratratpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2