Overview

overview

10

Static

static

3

720642a5aa...9b.exe

windows7-x64

10

720642a5aa...9b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    720642a5aac73117abe3552800bc6344a5046730683fa2ef7599a1e4d7f7f19b

  • Size

    1.4MB

  • Sample

    240526-l875raeg2z

  • MD5

    9cf47adebb159306ef76f296df974717

  • SHA1

    d3b47e54cd4211116e0804c9602bf1dd5bc92f8f

  • SHA256

    720642a5aac73117abe3552800bc6344a5046730683fa2ef7599a1e4d7f7f19b

  • SHA512

    7bc50a7582166d88cd004dd415d2e04a88ab2d826f03b00fef3600e837c37fd8418cc0b3df196d6cc035aabf8d80a71fd2fd7762a6c41f8c9327c517dfa76006

  • SSDEEP

    24576:eYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnfyzdd:eYREXSVMDi3I

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      720642a5aac73117abe3552800bc6344a5046730683fa2ef7599a1e4d7f7f19b

    • Size

      1.4MB

    • MD5

      9cf47adebb159306ef76f296df974717

    • SHA1

      d3b47e54cd4211116e0804c9602bf1dd5bc92f8f

    • SHA256

      720642a5aac73117abe3552800bc6344a5046730683fa2ef7599a1e4d7f7f19b

    • SHA512

      7bc50a7582166d88cd004dd415d2e04a88ab2d826f03b00fef3600e837c37fd8418cc0b3df196d6cc035aabf8d80a71fd2fd7762a6c41f8c9327c517dfa76006

    • SSDEEP

      24576:eYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnfyzdd:eYREXSVMDi3I

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks