Overview

overview

10

Static

static

3

2024-09-07...id.exe

windows7-x64

10

2024-09-07...id.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-09-07_5206f49106fe46d3b93282dbe56e2158_icedid

  • Size

    3.0MB

  • Sample

    240907-w3c3jaxgll

  • MD5

    5206f49106fe46d3b93282dbe56e2158

  • SHA1

    25e382f48b0db10b9118215fc764a05582701107

  • SHA256

    5b1b894af745518bbf941eb5ae91f984415ef00afb8125c0b3f6495fbcdb772f

  • SHA512

    ac1564ee10621700077ae9446e5dd5244aab29476a7932e6d7f6432318e20108e8658315cc1c00ee55d48d4e4e39928f0cd0b6816ad8866c85c8e447b9b3c321

  • SSDEEP

    49152:yYREXSVMDi3CccmJ5DQd1jlmDvkRAuFkuoJZEtMFniQX4O8b8ITDnlQV:X2SVMD8CccmJ6d1Z4kRAuFkkmn

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      2024-09-07_5206f49106fe46d3b93282dbe56e2158_icedid

    • Size

      3.0MB

    • MD5

      5206f49106fe46d3b93282dbe56e2158

    • SHA1

      25e382f48b0db10b9118215fc764a05582701107

    • SHA256

      5b1b894af745518bbf941eb5ae91f984415ef00afb8125c0b3f6495fbcdb772f

    • SHA512

      ac1564ee10621700077ae9446e5dd5244aab29476a7932e6d7f6432318e20108e8658315cc1c00ee55d48d4e4e39928f0cd0b6816ad8866c85c8e447b9b3c321

    • SSDEEP

      49152:yYREXSVMDi3CccmJ5DQd1jlmDvkRAuFkuoJZEtMFniQX4O8b8ITDnlQV:X2SVMD8CccmJ6d1Z4kRAuFkkmn

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks