Extracted

• • Target

    cad447f67f2548859a6c86a141bb1a2105417fdb9390d73424e67921c83271db.exe

  • Size

    32KB

  • MD5

    89c3536c954b7953413bb228833adaff

  • SHA1

    74cba0223e941f83037f0b497c6e0e6e205059d1

  • SHA256

    cad447f67f2548859a6c86a141bb1a2105417fdb9390d73424e67921c83271db

  • SHA512

    9f3a4ac749cfebe0ae065a52943933833c6462de814e74b37c7a51404db6f893a46a5458adc1f55dfd0b0519a635429867eec7f7cc1f7af1d4dfdca844f4bd92

  • SSDEEP

    768:Uw/iOWTK3JWhOM/qZh7UJGcZ/yKQcnbcuyD7U7s9:7QK52fqZSIAK0nouy87s9

  Score

  10^/10

  gh0stratrunningratdiscoverypersistenceratupx

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • RunningRat

    RunningRat is a remote access trojan first seen in 2018.

    ratrunningrat

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2