Overview

overview

10

Static

static

10

bed703e569...92.dll

windows7-x64

10

bed703e569...92.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bed703e56915500818f555c6493b2a7af29e40e4ec48df453528e1cd8e7bec92

  • Size

    51KB

  • Sample

    240523-j7fyrsae82

  • MD5

    cbe16baa94bdd9f1fd2d8eb974848d15

  • SHA1

    b951112974e7fd6d3ce9095ff66b6732be5d16f8

  • SHA256

    bed703e56915500818f555c6493b2a7af29e40e4ec48df453528e1cd8e7bec92

  • SHA512

    41c40b2f764d96319bc2d3b790a3a95c9c742e9a1f0872c3525e7d6aa82f4c5e1208995be58538af69f6a756aa79904a7a64fe8dc72206d021519bbb19a89593

  • SSDEEP

    1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLMJYH5:1dWubF3n9S91BF3fboYJYH5

Score
10/10
gh0stratrat

Malware Config

Extracted

Family

gh0strat

C2

kinh.xmcxmr.com

Targets

    • Target

      bed703e56915500818f555c6493b2a7af29e40e4ec48df453528e1cd8e7bec92

    • Size

      51KB

    • MD5

      cbe16baa94bdd9f1fd2d8eb974848d15

    • SHA1

      b951112974e7fd6d3ce9095ff66b6732be5d16f8

    • SHA256

      bed703e56915500818f555c6493b2a7af29e40e4ec48df453528e1cd8e7bec92

    • SHA512

      41c40b2f764d96319bc2d3b790a3a95c9c742e9a1f0872c3525e7d6aa82f4c5e1208995be58538af69f6a756aa79904a7a64fe8dc72206d021519bbb19a89593

    • SSDEEP

      1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLMJYH5:1dWubF3n9S91BF3fboYJYH5

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks