Overview

overview

10

Static

static

10

78365a7b76...0N.dll

windows7-x64

10

78365a7b76...0N.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    78365a7b766cc0ada4e4614957f8f940N.exe

  • Size

    899KB

  • Sample

    240727-bkn2vsxblq

  • MD5

    78365a7b766cc0ada4e4614957f8f940

  • SHA1

    a482d51592a680765535c8d4b88ab96f7da5faa8

  • SHA256

    37b306b95841f325e66a1b28c81798512ab9ac90ff71f300facbe8fff3a19678

  • SHA512

    aae016ca8af7b1d1afdb6b07f81131d1d74ca682cb51e506b97c4bdec242e6226dac045dc9d7df01b1c2d7bf0cea776c95ab89a35f7852a5c711b7093288e215

  • SSDEEP

    24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXm:7wqd87Vm

Score
10/10
gh0stratdiscoveryrat

Malware Config

Extracted

Family

gh0strat

C2

hackerinvasion.f3322.net

Targets

    • Target

      78365a7b766cc0ada4e4614957f8f940N.exe

    • Size

      899KB

    • MD5

      78365a7b766cc0ada4e4614957f8f940

    • SHA1

      a482d51592a680765535c8d4b88ab96f7da5faa8

    • SHA256

      37b306b95841f325e66a1b28c81798512ab9ac90ff71f300facbe8fff3a19678

    • SHA512

      aae016ca8af7b1d1afdb6b07f81131d1d74ca682cb51e506b97c4bdec242e6226dac045dc9d7df01b1c2d7bf0cea776c95ab89a35f7852a5c711b7093288e215

    • SSDEEP

      24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXm:7wqd87Vm

    Score
    10/10
    gh0stratdiscoveryrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks