Overview

overview

10

Static

static

3

01be1ab883...fa.exe

windows7-x64

10

01be1ab883...fa.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    01be1ab883a4ea56e2e093faf4e67cc640e52ab97ed91a36da8a15bc68a944fa

  • Size

    1.5MB

  • Sample

    240529-j1np2aga7z

  • MD5

    1c6b82d829fa553b92fff50595951181

  • SHA1

    96494106a002fe7cfe746a00a34bd108f025a020

  • SHA256

    01be1ab883a4ea56e2e093faf4e67cc640e52ab97ed91a36da8a15bc68a944fa

  • SHA512

    181bab87aaed7138800d1debd4ddd375839b7f2b50d728d342605c4ff733cbe0c4b48ab8f55cb0d966adc2582fcdaf93d3d8334195ef60b442db5a1cb4056f57

  • SSDEEP

    24576:QYFbkIsaPiXSVnC7Yp9zkNmZG8RRln3yzH9:QYREXSVMDi3q

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      01be1ab883a4ea56e2e093faf4e67cc640e52ab97ed91a36da8a15bc68a944fa

    • Size

      1.5MB

    • MD5

      1c6b82d829fa553b92fff50595951181

    • SHA1

      96494106a002fe7cfe746a00a34bd108f025a020

    • SHA256

      01be1ab883a4ea56e2e093faf4e67cc640e52ab97ed91a36da8a15bc68a944fa

    • SHA512

      181bab87aaed7138800d1debd4ddd375839b7f2b50d728d342605c4ff733cbe0c4b48ab8f55cb0d966adc2582fcdaf93d3d8334195ef60b442db5a1cb4056f57

    • SSDEEP

      24576:QYFbkIsaPiXSVnC7Yp9zkNmZG8RRln3yzH9:QYREXSVMDi3q

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Sets DLL path for service in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks