Overview

overview

10

Static

static

3

fabd0e387a...dd.exe

windows7-x64

10

fabd0e387a...dd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fabd0e387a5691143ed5bb67cc20b2c54707643e3bef55449e84de7451ecabdd

  • Size

    2.3MB

  • Sample

    240526-pkn9hsch42

  • MD5

    8fbf3c62693a58260124b316ff137a3e

  • SHA1

    1b8423d3a36c52d4f6b4cb454463435dca3562a9

  • SHA256

    fabd0e387a5691143ed5bb67cc20b2c54707643e3bef55449e84de7451ecabdd

  • SHA512

    8c70759972b4a7d56bdb06f67db493b1862a0afbe80c26d9d19e5e6978c56d792c7cec23750ba5ff369e36e5915cce0e0972ea04dcb2f2a51d12af2070c6a150

  • SSDEEP

    24576:KYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnZyzDs6u8ig6TcB+LoqSZQRbw+NAybxJFCS:KYREXSVMDi3riiy+LoqGQRbCIIPMflJ

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      fabd0e387a5691143ed5bb67cc20b2c54707643e3bef55449e84de7451ecabdd

    • Size

      2.3MB

    • MD5

      8fbf3c62693a58260124b316ff137a3e

    • SHA1

      1b8423d3a36c52d4f6b4cb454463435dca3562a9

    • SHA256

      fabd0e387a5691143ed5bb67cc20b2c54707643e3bef55449e84de7451ecabdd

    • SHA512

      8c70759972b4a7d56bdb06f67db493b1862a0afbe80c26d9d19e5e6978c56d792c7cec23750ba5ff369e36e5915cce0e0972ea04dcb2f2a51d12af2070c6a150

    • SSDEEP

      24576:KYFbkIsaPiXSVnC7Yp9zkNmZG8RRlnZyzDs6u8ig6TcB+LoqSZQRbw+NAybxJFCS:KYREXSVMDi3riiy+LoqGQRbCIIPMflJ

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks