Overview

overview

10

Static

static

3

1eaae465bd...9b.exe

windows7-x64

10

1eaae465bd...9b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1eaae465bda927c1893a5744301cde9b.exe

  • Size

    844KB

  • Sample

    240530-kq1ghscc5y

  • MD5

    1eaae465bda927c1893a5744301cde9b

  • SHA1

    6d5f62d54dda0a61f5f7a8b2cbbff86cf2ac2ae9

  • SHA256

    c297e02f804f7c95762ada2efb98866c6a509db4ace8bf06f95af3a41c8e702c

  • SHA512

    76a20258f1c43f620ad8f66916192c1a33c48ec2f4594107ad987088da3a500bff5ea5d3cd3954457aee09b2c44c36530cf00518398caf0c756f48b7b0aa7819

  • SSDEEP

    12288:VCQjgAtAHM+vetZxF5EWry8AJGy0/X+tMLNjG6pgt6cBUl48ij/ePdEkHwicLMdB:V5ZWs+OZVEWry8AFaNj5E6wUmx0pp

Score
10/10
gh0stratratupx

Malware Config

Targets

    • Target

      1eaae465bda927c1893a5744301cde9b.exe

    • Size

      844KB

    • MD5

      1eaae465bda927c1893a5744301cde9b

    • SHA1

      6d5f62d54dda0a61f5f7a8b2cbbff86cf2ac2ae9

    • SHA256

      c297e02f804f7c95762ada2efb98866c6a509db4ace8bf06f95af3a41c8e702c

    • SHA512

      76a20258f1c43f620ad8f66916192c1a33c48ec2f4594107ad987088da3a500bff5ea5d3cd3954457aee09b2c44c36530cf00518398caf0c756f48b7b0aa7819

    • SSDEEP

      12288:VCQjgAtAHM+vetZxF5EWry8AJGy0/X+tMLNjG6pgt6cBUl48ij/ePdEkHwicLMdB:V5ZWs+OZVEWry8AFaNj5E6wUmx0pp

    Score
    10/10
    gh0stratratupx

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks