gh0strat | 14f873bb4aa84aeec9a7d4d351a0ef5a28ada9885dfea43db7d20504a8d052c5 | Triage

Submit
Reports

Overview

overview

Static

static

3

b72db45458...18.exe

windows7-x64

b72db45458...18.exe

windows10-2004-x64

Sharing

General

Target

b72db4545857152305c999fb36a114b3_JaffaCakes118
Size

12.2MB
Sample

240822-lttntatbmr
MD5

b72db4545857152305c999fb36a114b3
SHA1

73994a7f24f160fe6bcbe1196216153a7a6eb40b
SHA256

14f873bb4aa84aeec9a7d4d351a0ef5a28ada9885dfea43db7d20504a8d052c5
SHA512

4f27750b30a26f32501cd20e80c17c235479644c1767d7db15b050830486ff8dc0c7778a77c1831b11371a0b8628b9212489bc72216a6f13f31fcf65aebc1662
SSDEEP

3072:ZUYsFlYXTGHsRW5WNqN90WFAfjg+vFCzTP8yTQfV4CfRD1UCPmvMF:ZnsFlYXTGHswlnF+fj3FCzT0yTKLLPmE

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b72db4545857152305c999fb36a114b3_JaffaCakes118.exe

Resource

win7-20240705-en

gh0strat discovery persistence rat

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

b72db4545857152305c999fb36a114b3_JaffaCakes118.exe

Resource

win10v2004-20240802-en

gh0strat discovery persistence rat

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  b72db4545857152305c999fb36a114b3_JaffaCakes118
- Size
  
  12.2MB
- MD5
  
  b72db4545857152305c999fb36a114b3
- SHA1
  
  73994a7f24f160fe6bcbe1196216153a7a6eb40b
- SHA256
  
  14f873bb4aa84aeec9a7d4d351a0ef5a28ada9885dfea43db7d20504a8d052c5
- SHA512
  
  4f27750b30a26f32501cd20e80c17c235479644c1767d7db15b050830486ff8dc0c7778a77c1831b11371a0b8628b9212489bc72216a6f13f31fcf65aebc1662
- SSDEEP
  
  3072:ZUYsFlYXTGHsRW5WNqN90WFAfjg+vFCzTP8yTQfV4CfRD1UCPmvMF:ZnsFlYXTGHswlnF+fj3FCzT0yTKLLPmE
Score

10^/10

gh0strat discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Blocklisted process makes network request
- Server Software Component: Terminal Services DLL
  persistence
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoverypersistencerat

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2024

Terms | Privacy