Overview

overview

10

Static

static

3

3f5d5449ad...ab.exe

windows7-x64

10

3f5d5449ad...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3f5d5449ade4726c3431baa52cf36dbf4b7101f112eac429f3b436499edb52ab

  • Size

    1.5MB

  • Sample

    240526-f4xwbsge31

  • MD5

    bd28eabf5a15f7b2eeba9c21231dbc7e

  • SHA1

    9f1f44f7b27462041af0bfc0dbce9abc1ed3c191

  • SHA256

    3f5d5449ade4726c3431baa52cf36dbf4b7101f112eac429f3b436499edb52ab

  • SHA512

    4f300720a62e2b575f0d7d1ab78730409f3b6c429029876c57dd7ada9e92f0291c40dc1450f6da17549f3673c15ad9650030d25de67a4f4a5420f7e31e1c10b8

  • SSDEEP

    24576:IYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnsyzl+So:IYREXSVMDi3cD

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      3f5d5449ade4726c3431baa52cf36dbf4b7101f112eac429f3b436499edb52ab

    • Size

      1.5MB

    • MD5

      bd28eabf5a15f7b2eeba9c21231dbc7e

    • SHA1

      9f1f44f7b27462041af0bfc0dbce9abc1ed3c191

    • SHA256

      3f5d5449ade4726c3431baa52cf36dbf4b7101f112eac429f3b436499edb52ab

    • SHA512

      4f300720a62e2b575f0d7d1ab78730409f3b6c429029876c57dd7ada9e92f0291c40dc1450f6da17549f3673c15ad9650030d25de67a4f4a5420f7e31e1c10b8

    • SSDEEP

      24576:IYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnsyzl+So:IYREXSVMDi3cD

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks