Overview

overview

10

Static

static

10

80cdebd27f...cs.exe

windows7-x64

10

80cdebd27f...cs.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics

  • Size

    148KB

  • Sample

    240510-gbt5eahd56

  • MD5

    80cdebd27ff716aa06cdb0356851b510

  • SHA1

    347d25a4e185da01ea7baf722c14f7201b072463

  • SHA256

    7d7965c7d41a259a4e50ca518be8a54e8c8b23f47fe1209b5064a57f2a4e8f6f

  • SHA512

    52cef3f076b36de130c246e7d88c1328492e2a877edfe6d0f353b0e14a58c096ad9b0d2040fcacd2a77783fdeccae5343db26a1cbf34711949dfa89f3a4a8ba8

  • SSDEEP

    3072:9D0nN7yeSWORQtkdJv5hMFULTvtcMk8Lyji8lkivl05K5i+ITqn:StyeSWORdJRG4GMkSQi8Tvl05K5DIen

Score
10/10
gh0stratpersistenceratupx

Malware Config

Targets

    • Target

      80cdebd27ff716aa06cdb0356851b510_NeikiAnalytics

    • Size

      148KB

    • MD5

      80cdebd27ff716aa06cdb0356851b510

    • SHA1

      347d25a4e185da01ea7baf722c14f7201b072463

    • SHA256

      7d7965c7d41a259a4e50ca518be8a54e8c8b23f47fe1209b5064a57f2a4e8f6f

    • SHA512

      52cef3f076b36de130c246e7d88c1328492e2a877edfe6d0f353b0e14a58c096ad9b0d2040fcacd2a77783fdeccae5343db26a1cbf34711949dfa89f3a4a8ba8

    • SSDEEP

      3072:9D0nN7yeSWORQtkdJv5hMFULTvtcMk8Lyji8lkivl05K5i+ITqn:StyeSWORdJRG4GMkSQi8Tvl05K5DIen

    Score
    10/10
    gh0stratpersistenceratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks