General

  • Target

    a045dcaf7519a45b16068cad76467bd90b552571200c930ea4d4880416c5f39b.exe

  • Size

    32KB

  • Sample

    240821-mvj2fatgnb

  • MD5

    063eac49dce280735483eda62ccfd437

  • SHA1

    7bc157cd1d16e61497c6ccf0db0c5fc9a103c7b7

  • SHA256

    a045dcaf7519a45b16068cad76467bd90b552571200c930ea4d4880416c5f39b

  • SHA512

    088346741d9076da6456504a37cc8cca01a0222cb641015254bd7924c5c089f9b9394037dc6f0c8796fbe9b81d35df9486c92d3b8f9f63c43f83115329a8884f

  • SSDEEP

    768:Fw/iOWTK3JWhOM/qZh7UJGcZ/81uwO+0pzx2onbcuyD7U7s9:mQK52fqZSIAlx2onouy87s9

Malware Config

Extracted

Family

gh0strat

C2

p.f2pool.info

Targets

    • Target

      a045dcaf7519a45b16068cad76467bd90b552571200c930ea4d4880416c5f39b.exe

    • Size

      32KB

    • MD5

      063eac49dce280735483eda62ccfd437

    • SHA1

      7bc157cd1d16e61497c6ccf0db0c5fc9a103c7b7

    • SHA256

      a045dcaf7519a45b16068cad76467bd90b552571200c930ea4d4880416c5f39b

    • SHA512

      088346741d9076da6456504a37cc8cca01a0222cb641015254bd7924c5c089f9b9394037dc6f0c8796fbe9b81d35df9486c92d3b8f9f63c43f83115329a8884f

    • SSDEEP

      768:Fw/iOWTK3JWhOM/qZh7UJGcZ/81uwO+0pzx2onbcuyD7U7s9:mQK52fqZSIAlx2onouy87s9

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • RunningRat

      RunningRat is a remote access trojan first seen in 2018.

    • Server Software Component: Terminal Services DLL

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Creates a Windows Service

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.