Overview

overview

10

Static

static

10

81160b95ce...a2.dll

windows7-x64

10

81160b95ce...a2.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81160b95ce2fee9e4e21c9e8e15aa29584c2cb2f7d33b8dc40f15db1937cdaa2

  • Size

    51KB

  • Sample

    240526-hdazzsab2w

  • MD5

    f3dd06eb95b3be3f62f92fb678719782

  • SHA1

    0c41f4259d5cc153cf3b354b4874ce757fc1a850

  • SHA256

    81160b95ce2fee9e4e21c9e8e15aa29584c2cb2f7d33b8dc40f15db1937cdaa2

  • SHA512

    c5f2da6d37d493fce3721c4398d060da7104fb7012b0d2b4fadd556cc7beafa85b58adc71eb648fd45fde2ee3308b6165df8436470f7bb553e2c3f9264ad1240

  • SSDEEP

    1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLPJYH5:1dWubF3n9S91BF3fbozJYH5

Score
10/10
gh0stratrat

Malware Config

Extracted

Family

gh0strat

C2

kinh.xmcxmr.com

Targets

    • Target

      81160b95ce2fee9e4e21c9e8e15aa29584c2cb2f7d33b8dc40f15db1937cdaa2

    • Size

      51KB

    • MD5

      f3dd06eb95b3be3f62f92fb678719782

    • SHA1

      0c41f4259d5cc153cf3b354b4874ce757fc1a850

    • SHA256

      81160b95ce2fee9e4e21c9e8e15aa29584c2cb2f7d33b8dc40f15db1937cdaa2

    • SHA512

      c5f2da6d37d493fce3721c4398d060da7104fb7012b0d2b4fadd556cc7beafa85b58adc71eb648fd45fde2ee3308b6165df8436470f7bb553e2c3f9264ad1240

    • SSDEEP

      1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLPJYH5:1dWubF3n9S91BF3fbozJYH5

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks