General
-
Target
161d2fdc076fdabf7739ef712d3dc7a3c5fcf61bdd6ef7d219a0999487ffd0fa
-
Size
4.4MB
-
Sample
240523-tt9c9sgh3v
-
MD5
b25dd38bce0014e8b7b88bdaaf1721d0
-
SHA1
24d73f7d747ff83538f9b73a73650876b08174a8
-
SHA256
161d2fdc076fdabf7739ef712d3dc7a3c5fcf61bdd6ef7d219a0999487ffd0fa
-
SHA512
f643106fa27061f3bacc909067eea9d4baf4273467b468530e433af98b55087af0d6453db7262d4f744d8a44b95abcc6c25b767a32bcee68886a1700c6479124
-
SSDEEP
98304:pws2ANnKXOaeOgmhFMnsmtk2anGMcbBXlmI4:bKXbeO7PiL9McbL4
Static task
static1
Behavioral task
behavioral1
Sample
161d2fdc076fdabf7739ef712d3dc7a3c5fcf61bdd6ef7d219a0999487ffd0fa.exe
Resource
win7-20240419-en
Malware Config
Targets
-
-
Target
161d2fdc076fdabf7739ef712d3dc7a3c5fcf61bdd6ef7d219a0999487ffd0fa
-
Size
4.4MB
-
MD5
b25dd38bce0014e8b7b88bdaaf1721d0
-
SHA1
24d73f7d747ff83538f9b73a73650876b08174a8
-
SHA256
161d2fdc076fdabf7739ef712d3dc7a3c5fcf61bdd6ef7d219a0999487ffd0fa
-
SHA512
f643106fa27061f3bacc909067eea9d4baf4273467b468530e433af98b55087af0d6453db7262d4f744d8a44b95abcc6c25b767a32bcee68886a1700c6479124
-
SSDEEP
98304:pws2ANnKXOaeOgmhFMnsmtk2anGMcbBXlmI4:bKXbeO7PiL9McbL4
-
Gh0st RAT payload
-
Drops file in Drivers directory
-
Sets DLL path for service in the registry
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-