Overview

overview

10

Static

static

10

48343fdf20...5d.dll

windows7-x64

10

48343fdf20...5d.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    48343fdf20e634304b81ef74bb9d77af2d7bbe4bf83f244263dab8a7760e3f5d

  • Size

    51KB

  • Sample

    240523-j828dsaf5v

  • MD5

    50d9d39b2eae9b641c8823bd5f4fa199

  • SHA1

    df77bd8dc22698f005b6e6a441ea2f8db80a560c

  • SHA256

    48343fdf20e634304b81ef74bb9d77af2d7bbe4bf83f244263dab8a7760e3f5d

  • SHA512

    16672e7e7850f98c08b2c86d72063ba3ae0502b977c44a9c35bb0d6a4e9ec6fc15fd410df8913e2232f5d845ec7154908a295b9dafdfaa39f7229ef945031d22

  • SSDEEP

    1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLzJYH5:1dWubF3n9S91BF3fboHJYH5

Score
10/10
gh0stratrat

Malware Config

Extracted

Family

gh0strat

C2

kinh.xmcxmr.com

Targets

    • Target

      48343fdf20e634304b81ef74bb9d77af2d7bbe4bf83f244263dab8a7760e3f5d

    • Size

      51KB

    • MD5

      50d9d39b2eae9b641c8823bd5f4fa199

    • SHA1

      df77bd8dc22698f005b6e6a441ea2f8db80a560c

    • SHA256

      48343fdf20e634304b81ef74bb9d77af2d7bbe4bf83f244263dab8a7760e3f5d

    • SHA512

      16672e7e7850f98c08b2c86d72063ba3ae0502b977c44a9c35bb0d6a4e9ec6fc15fd410df8913e2232f5d845ec7154908a295b9dafdfaa39f7229ef945031d22

    • SSDEEP

      1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLzJYH5:1dWubF3n9S91BF3fboHJYH5

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks