Extracted

• • Target

    d61fea7347d18ea1460d17f8b90cb089ea9982f25e3625872574fca8e8f72d6b

  • Size

    1.2MB

  • MD5

    037b5afc971b59a356bfe076734b165b

  • SHA1

    aed4684d046c5fb1687003798ada37618448268c

  • SHA256

    d61fea7347d18ea1460d17f8b90cb089ea9982f25e3625872574fca8e8f72d6b

  • SHA512

    6d35f17d0ff1a5522cc4a1c44c302c1bd1b05e0c554a57524fdbd0d097b1eb49b605e125610331034b940e5347f6b6ff378c1dff4f48db96ddfa1910f10b8f52

  • SSDEEP

    24576:iTOgQM/++dshTB9/EkgPY1qOeb+SBpaO5F+pfTZJpqPT/qL:iBYd9/jmnJqO5FeDQPG

  Score

  10^/10

  gh0stratratvmprotectpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Executes dropped EXE

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2