Extracted

• • Target

    ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925

  • Size

    404KB

  • MD5

    e5b64b28b136c736b6ce2a3d15c40858

  • SHA1

    d7846e2715f2915eecd1905581e11d3ba2b55c41

  • SHA256

    ca505468106b663042874d6ea339e06489ada784f3f51792d9a5119e8ce73925

  • SHA512

    40e7b2936430847189c4d20497ca2f0f64ec184619290bc56abafa437d9d253a2c4d247c2e46ce2183dffb220cfece9f6784a2f80e77241f839a6a535f14fc1f

  • SSDEEP

    6144:5yyLEbWaR5Cc1KKwPo+B1IcWn29BpwNZHZLpyyJhhhhhhhhhhhhhhhZbQJ:kUaWaR5vGsco2tw1LfRi

  Score

  10^/10

  gh0stratratpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2