Overview

overview

10

Static

static

3

9fbb3b5679...20.exe

windows7-x64

10

9fbb3b5679...20.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9fbb3b567983286b693a17f9655b35837c7ad89efc5b9b6263fa23694b7f2a20

  • Size

    4.5MB

  • Sample

    240526-e833gafb9x

  • MD5

    e10dce896015c8324416e373461404d5

  • SHA1

    67cd18172fd38be979fb21ddd2eba4da288d5d1f

  • SHA256

    9fbb3b567983286b693a17f9655b35837c7ad89efc5b9b6263fa23694b7f2a20

  • SHA512

    4c8044fc84a930d96b1e0229cbb59206f9e8c5bfdf2302df178252633edc014489a352b522f662aae8af58da11b8426fc7960dd3a508835b1810ec9c5e8d24b9

  • SSDEEP

    49152:iYREXSVMDi3RbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PLn:H2SVMD8RbXsPN5kiQaZ56

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      9fbb3b567983286b693a17f9655b35837c7ad89efc5b9b6263fa23694b7f2a20

    • Size

      4.5MB

    • MD5

      e10dce896015c8324416e373461404d5

    • SHA1

      67cd18172fd38be979fb21ddd2eba4da288d5d1f

    • SHA256

      9fbb3b567983286b693a17f9655b35837c7ad89efc5b9b6263fa23694b7f2a20

    • SHA512

      4c8044fc84a930d96b1e0229cbb59206f9e8c5bfdf2302df178252633edc014489a352b522f662aae8af58da11b8426fc7960dd3a508835b1810ec9c5e8d24b9

    • SSDEEP

      49152:iYREXSVMDi3RbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PLn:H2SVMD8RbXsPN5kiQaZ56

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks