gh0strat | a59d8f8b50895415ad385db99210dc93c8b85c7a47611e05c1d138ffd04a2059 | Triage

Submit
Reports

Overview

overview

Static

static

3

a59d8f8b50...59.exe

windows7-x64

a59d8f8b50...59.exe

windows10-2004-x64

Sharing

General

Target

a59d8f8b50895415ad385db99210dc93c8b85c7a47611e05c1d138ffd04a2059
Size

5.1MB
Sample

240904-r6c5gssdkm
MD5

4feb720a7aec2487dd4ae56523b2aedb
SHA1

460c6426d476054460d6edbbce2dace0b34f8bd2
SHA256

a59d8f8b50895415ad385db99210dc93c8b85c7a47611e05c1d138ffd04a2059
SHA512

2479974b03ae0a14b821050f2bc3386f02b8369d1d78612b4f561f964cb5d4cfd1b8867a8384978371eab54c524395d6c5e131866b43443989cee94d1619ccd3
SSDEEP

49152:sYREXSVMDi31ccmJ5DQd1jObXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8w:12SVMD81ccmJ6d1SbXsPN5kiQaZ56

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a59d8f8b50895415ad385db99210dc93c8b85c7a47611e05c1d138ffd04a2059.exe

Resource

win7-20240903-en

gh0strat discovery persistence rat

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

a59d8f8b50895415ad385db99210dc93c8b85c7a47611e05c1d138ffd04a2059.exe

Resource

win10v2004-20240802-en

gh0strat discovery persistence rat

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  a59d8f8b50895415ad385db99210dc93c8b85c7a47611e05c1d138ffd04a2059
- Size
  
  5.1MB
- MD5
  
  4feb720a7aec2487dd4ae56523b2aedb
- SHA1
  
  460c6426d476054460d6edbbce2dace0b34f8bd2
- SHA256
  
  a59d8f8b50895415ad385db99210dc93c8b85c7a47611e05c1d138ffd04a2059
- SHA512
  
  2479974b03ae0a14b821050f2bc3386f02b8369d1d78612b4f561f964cb5d4cfd1b8867a8384978371eab54c524395d6c5e131866b43443989cee94d1619ccd3
- SSDEEP
  
  49152:sYREXSVMDi31ccmJ5DQd1jObXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8w:12SVMD81ccmJ6d1SbXsPN5kiQaZ56
Score

10^/10

gh0strat discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Server Software Component: Terminal Services DLL
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoverypersistencerat

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2025

Terms | Privacy