General
-
Target
407a800a506a90fa09f4ae1d3e1d88e53de1aa293e0fe4c2a4289413cd1c6a64
-
Size
2.6MB
-
Sample
240725-q6hvasvdrf
-
MD5
ece48dfee5ac01eba7d50b52c2d90bcc
-
SHA1
dce14a2c48c0185d0b8a8b74197e99557474ea1c
-
SHA256
407a800a506a90fa09f4ae1d3e1d88e53de1aa293e0fe4c2a4289413cd1c6a64
-
SHA512
dd4877d1fc51e6be1bdb5010e288486b54e61f8cee2b3b84de625de29205aaab37d05c6b3d4512098dc24ee33c11e0d9ff8775722508dd65e8e2da7dd1efbd39
-
SSDEEP
24576:ZCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHS:ZCwsbCANnKXferL7Vwe/Gg0P+WhwHTG
Static task
static1
Behavioral task
behavioral1
Sample
407a800a506a90fa09f4ae1d3e1d88e53de1aa293e0fe4c2a4289413cd1c6a64.exe
Resource
win7-20240704-en
Malware Config
Targets
-
-
Target
407a800a506a90fa09f4ae1d3e1d88e53de1aa293e0fe4c2a4289413cd1c6a64
-
Size
2.6MB
-
MD5
ece48dfee5ac01eba7d50b52c2d90bcc
-
SHA1
dce14a2c48c0185d0b8a8b74197e99557474ea1c
-
SHA256
407a800a506a90fa09f4ae1d3e1d88e53de1aa293e0fe4c2a4289413cd1c6a64
-
SHA512
dd4877d1fc51e6be1bdb5010e288486b54e61f8cee2b3b84de625de29205aaab37d05c6b3d4512098dc24ee33c11e0d9ff8775722508dd65e8e2da7dd1efbd39
-
SSDEEP
24576:ZCwsbKgbQ5NANIvGTYwMHXA+wT1kfTw4SIuvB74fgt7ibhRM5QhKehFdMtRj7nHS:ZCwsbCANnKXferL7Vwe/Gg0P+WhwHTG
-
Gh0st RAT payload
-
Drops file in Drivers directory
-
Server Software Component: Terminal Services DLL
-
Sets service image path in registry
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1