General
-
Target
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb
-
Size
4.4MB
-
Sample
240526-h8hy3sca98
-
MD5
fd37327f6c3016a4621c4ed4d499dbc2
-
SHA1
630c9b0dd6b29641e70b36a1c4a62eff874ef845
-
SHA256
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb
-
SHA512
11630832ae114099d2181be3b775ce40830a199da92113c72d3efc9d0739895aaad13fb071ed3f155444d85c4fb30d652ad5a82bb13fa22de0cbeb573a9a192a
-
SSDEEP
98304:Dws2ANnKXOaeOgmhy0Rmn9zd308KDG235p:FKXbeO77S2pp
Static task
static1
Behavioral task
behavioral1
Sample
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb.exe
Resource
win7-20240221-en
Malware Config
Targets
-
-
Target
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb
-
Size
4.4MB
-
MD5
fd37327f6c3016a4621c4ed4d499dbc2
-
SHA1
630c9b0dd6b29641e70b36a1c4a62eff874ef845
-
SHA256
1e820ed6dccf8ec6694a9113c9c173cc3a347b5c5e34c093c104da0f82f47afb
-
SHA512
11630832ae114099d2181be3b775ce40830a199da92113c72d3efc9d0739895aaad13fb071ed3f155444d85c4fb30d652ad5a82bb13fa22de0cbeb573a9a192a
-
SSDEEP
98304:Dws2ANnKXOaeOgmhy0Rmn9zd308KDG235p:FKXbeO77S2pp
-
Gh0st RAT payload
-
Drops file in Drivers directory
-
Sets DLL path for service in the registry
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-