Overview

overview

10

Static

static

10

502702675b...3b.dll

windows7-x64

10

502702675b...3b.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    502702675b211d84b3be2413a8394a3c2b7b6d072ee1ac211a49789f68508c3b

  • Size

    899KB

  • Sample

    240522-3br6psch6t

  • MD5

    b8350bf7d7d84a697cbd250687962e2a

  • SHA1

    db79d25b65364d5ca270e3d2ba94e65726da08f9

  • SHA256

    502702675b211d84b3be2413a8394a3c2b7b6d072ee1ac211a49789f68508c3b

  • SHA512

    12298ed4b741e165229b8ffdb6c4c45b1cd5d9d84cbd05f5dc216a938b7a4856b63c39c96cfaa573b37d3ca2f591c4069021cc281ba9896b4b13898ad919ea01

  • SSDEEP

    24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXB:7wqd87VB

Score
10/10
gh0stratrat

Malware Config

Extracted

Family

gh0strat

C2

hackerinvasion.f3322.net

Targets

    • Target

      502702675b211d84b3be2413a8394a3c2b7b6d072ee1ac211a49789f68508c3b

    • Size

      899KB

    • MD5

      b8350bf7d7d84a697cbd250687962e2a

    • SHA1

      db79d25b65364d5ca270e3d2ba94e65726da08f9

    • SHA256

      502702675b211d84b3be2413a8394a3c2b7b6d072ee1ac211a49789f68508c3b

    • SHA512

      12298ed4b741e165229b8ffdb6c4c45b1cd5d9d84cbd05f5dc216a938b7a4856b63c39c96cfaa573b37d3ca2f591c4069021cc281ba9896b4b13898ad919ea01

    • SSDEEP

      24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXB:7wqd87VB

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks