Overview

overview

10

Static

static

3

23987e3f97...da.dll

windows7-x64

3

23987e3f97...da.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    23987e3f9785c991aca61609c23ad4d413b623a5e8289621ce4ba59587d88dda

  • Size

    137KB

  • Sample

    240906-l89ctazhll

  • MD5

    beaf76e6c3db72eaf18d0846971601d0

  • SHA1

    50d30db5b5597c5246cab943060867d2603db6f9

  • SHA256

    23987e3f9785c991aca61609c23ad4d413b623a5e8289621ce4ba59587d88dda

  • SHA512

    f569f87081b1032474ca582dadb3d440a864062823f60e140de8036a9406a0d96da24a55f8090b2069da8f937936d7d90f009122677809cc02dfd9571b41f289

  • SSDEEP

    3072:IR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuq:d25GgFny61mrao

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      23987e3f9785c991aca61609c23ad4d413b623a5e8289621ce4ba59587d88dda

    • Size

      137KB

    • MD5

      beaf76e6c3db72eaf18d0846971601d0

    • SHA1

      50d30db5b5597c5246cab943060867d2603db6f9

    • SHA256

      23987e3f9785c991aca61609c23ad4d413b623a5e8289621ce4ba59587d88dda

    • SHA512

      f569f87081b1032474ca582dadb3d440a864062823f60e140de8036a9406a0d96da24a55f8090b2069da8f937936d7d90f009122677809cc02dfd9571b41f289

    • SSDEEP

      3072:IR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuq:d25GgFny61mrao

    Score
    10/10
    discoverygh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

      persistence

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks