Extracted

• • Target

    2024-07-06_198c838391f0281ad9a30cef7d242da3_mafia

  • Size

    2.8MB

  • MD5

    198c838391f0281ad9a30cef7d242da3

  • SHA1

    8d65879c43c28b69fd499885c0bf8b8886cbf9d6

  • SHA256

    7106a351ad1e0c6d256b8ed89db8eec1425aa559c53f24d943cd842ccd42afe7

  • SHA512

    06d8ed30077e0c654324ab20d3fc89abef9465cd657b5e8db4cd2655ce12b82ea5c0928bf399bbef8e7b48853f7655453df2d64af2e4d3744940da5f69c5ba51

  • SSDEEP

    49152:x/+WSk4sI39QE+OaKCBI1ZBGLRqmTowog5l6uUFwQbLpX+yVg+3LSku9osDTvZ9d:hSk4sI39H+Oaha1zGL9TowP5l6uUF5by

  Score

  10^/10

  gh0stratratpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2