Overview

overview

10

Static

static

10

b016590f3b...b6.dll

windows7-x64

10

b016590f3b...b6.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b016590f3b96548f6c97c3539cb7c3aa251795b4b7dbf08881905f6fdaae5cb6

  • Size

    50KB

  • Sample

    240526-kbpfpsdb58

  • MD5

    256a74274f8343491a107bae0333c1e0

  • SHA1

    0bc838e62f441402b68c90a16dfef8e127faa175

  • SHA256

    b016590f3b96548f6c97c3539cb7c3aa251795b4b7dbf08881905f6fdaae5cb6

  • SHA512

    c142293412bd6713cfbfa3f447372bab850e2c165217d918e211ba4822deda7d2a3cb54251ad7ed1e3a7d407747a45974a2a761fb96a6bad61e236c634c4238f

  • SSDEEP

    1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5/JYH:W5ReWjTrW9rNPgYoNJYH

Score
10/10
gh0stratrat

Malware Config

Extracted

Family

gh0strat

C2

hackerinvasion.f3322.net

Targets

    • Target

      b016590f3b96548f6c97c3539cb7c3aa251795b4b7dbf08881905f6fdaae5cb6

    • Size

      50KB

    • MD5

      256a74274f8343491a107bae0333c1e0

    • SHA1

      0bc838e62f441402b68c90a16dfef8e127faa175

    • SHA256

      b016590f3b96548f6c97c3539cb7c3aa251795b4b7dbf08881905f6fdaae5cb6

    • SHA512

      c142293412bd6713cfbfa3f447372bab850e2c165217d918e211ba4822deda7d2a3cb54251ad7ed1e3a7d407747a45974a2a761fb96a6bad61e236c634c4238f

    • SSDEEP

      1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o5/JYH:W5ReWjTrW9rNPgYoNJYH

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks