General
-
Target
d34b300dea4cb02902be18e5ffac2d219948671c06052ae1b8b4e3301c255dca
-
Size
7.2MB
-
Sample
240524-sh37faab6s
-
MD5
880814a8c2304729007fa0a008587dc5
-
SHA1
1adc9fc4d58e6271f1db89187e3918bd36147887
-
SHA256
d34b300dea4cb02902be18e5ffac2d219948671c06052ae1b8b4e3301c255dca
-
SHA512
500dfa0d04dee632f0f6733f244e52126c5ff671c459d9705cb9507acbdaa262fbc474d72dc6459d0ce254662e8c2ca7d7afb68ca60a938a1352a9e2252e158e
-
SSDEEP
98304:9ws2ANnKXOaeOgmhM3nsmtk2aTigPzUYm9uALfprsQunQf7UORs:nKXbeO7QLKsuAdty
Static task
static1
Malware Config
Targets
-
-
Target
d34b300dea4cb02902be18e5ffac2d219948671c06052ae1b8b4e3301c255dca
-
Size
7.2MB
-
MD5
880814a8c2304729007fa0a008587dc5
-
SHA1
1adc9fc4d58e6271f1db89187e3918bd36147887
-
SHA256
d34b300dea4cb02902be18e5ffac2d219948671c06052ae1b8b4e3301c255dca
-
SHA512
500dfa0d04dee632f0f6733f244e52126c5ff671c459d9705cb9507acbdaa262fbc474d72dc6459d0ce254662e8c2ca7d7afb68ca60a938a1352a9e2252e158e
-
SSDEEP
98304:9ws2ANnKXOaeOgmhM3nsmtk2aTigPzUYm9uALfprsQunQf7UORs:nKXbeO7QLKsuAdty
-
Gh0st RAT payload
-
Drops file in Drivers directory
-
Sets DLL path for service in the registry
-
Sets service image path in registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-