Overview

overview

10

Static

static

3

2024-09-06...id.exe

windows7-x64

10

2024-09-06...id.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-09-06_559da0934bd1c13da795b09b7e5ecf4b_hijackloader_icedid

  • Size

    4.6MB

  • Sample

    240907-axwrsswapn

  • MD5

    559da0934bd1c13da795b09b7e5ecf4b

  • SHA1

    ed3b9d08c344fb81f84e00721d9352f6e6a10be7

  • SHA256

    405276276b946585c453cc869533d0e00b7ba45cf09a074f3244ddd5d57cc847

  • SHA512

    b74276955abe003215902291ffbe01758f52578589eaf33c019eb41f321c9297f88ca083d9784d17730974ea1f5277737ed707962b46aa29ec3ba4b1578b73bd

  • SSDEEP

    49152:2YREXSVMKi3ubXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PLn:z2SVMK8ubXsPN5kiQaZ56

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      2024-09-06_559da0934bd1c13da795b09b7e5ecf4b_hijackloader_icedid

    • Size

      4.6MB

    • MD5

      559da0934bd1c13da795b09b7e5ecf4b

    • SHA1

      ed3b9d08c344fb81f84e00721d9352f6e6a10be7

    • SHA256

      405276276b946585c453cc869533d0e00b7ba45cf09a074f3244ddd5d57cc847

    • SHA512

      b74276955abe003215902291ffbe01758f52578589eaf33c019eb41f321c9297f88ca083d9784d17730974ea1f5277737ed707962b46aa29ec3ba4b1578b73bd

    • SSDEEP

      49152:2YREXSVMKi3ubXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PLn:z2SVMK8ubXsPN5kiQaZ56

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks