gh0strat | 566d8e22ac7d8f5f21b99b37be4a10432b3652418f70e6cdbd45b6ea9927fe25 | Triage

Submit
Reports

Overview

overview

Static

static

3

d110b35ffa...18.exe

windows7-x64

d110b35ffa...18.exe

windows10-2004-x64

Sharing

General

Target

d110b35ffa74bab662fd1a0e7b9fa5ba_JaffaCakes118
Size

32KB
Sample

240907-ezlrtsvbpn
MD5

d110b35ffa74bab662fd1a0e7b9fa5ba
SHA1

e39c2d0693f42ef893935bfeb3d8ee74a6cbbf97
SHA256

566d8e22ac7d8f5f21b99b37be4a10432b3652418f70e6cdbd45b6ea9927fe25
SHA512

81690e46c22914a72a0b3ecaebad516c0b5c870d36e941ab276b75b346c5407094aa692902ace13b74a9c2dab4f4601b8894d4bc976d5adfbd653805d0331be6
SSDEEP

768:Nw2N4ape4Mm0RxD0ABx4owGAzEZrW0O4q+HkPx3b:Nw2NjpymixD0A/Nw/MBq+Ep3b

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

d110b35ffa74bab662fd1a0e7b9fa5ba_JaffaCakes118.exe

Resource

win7-20240903-en

gh0strat discovery persistence rat

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

d110b35ffa74bab662fd1a0e7b9fa5ba_JaffaCakes118.exe

Resource

win10v2004-20240802-en

gh0strat discovery persistence rat

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  d110b35ffa74bab662fd1a0e7b9fa5ba_JaffaCakes118
- Size
  
  32KB
- MD5
  
  d110b35ffa74bab662fd1a0e7b9fa5ba
- SHA1
  
  e39c2d0693f42ef893935bfeb3d8ee74a6cbbf97
- SHA256
  
  566d8e22ac7d8f5f21b99b37be4a10432b3652418f70e6cdbd45b6ea9927fe25
- SHA512
  
  81690e46c22914a72a0b3ecaebad516c0b5c870d36e941ab276b75b346c5407094aa692902ace13b74a9c2dab4f4601b8894d4bc976d5adfbd653805d0331be6
- SSDEEP
  
  768:Nw2N4ape4Mm0RxD0ABx4owGAzEZrW0O4q+HkPx3b:Nw2NjpymixD0A/Nw/MBq+Ep3b
Score

10^/10

gh0strat discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Server Software Component: Terminal Services DLL
  persistence
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoverypersistencerat

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2024

Terms | Privacy