Extracted

• • Target

    8473d4b398a72605f8cfbffbc45709f9267a173208cb8814caba98b4d8c53303

  • Size

    133KB

  • MD5

    395bb7ea9944773809df27b69422d67b

  • SHA1

    0c422257fa0917e4e176a74dc46f059abc8859f4

  • SHA256

    8473d4b398a72605f8cfbffbc45709f9267a173208cb8814caba98b4d8c53303

  • SHA512

    12ef46e547db9a13969300e7a4723aa0ab4f99229f68c528c140f0da8967267dea65004306b9b63476612567bc3103e4b6bb273f2162f3a06f2a1d6912e61d64

  • SSDEEP

    3072:6yIpG2/iDbYvGY4/BL/MDOw//5zzDVL7Jjk/dR8iV:rIposOpwJzzi8iV

  Score

  10^/10

  gh0stratdiscoveryratupxpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2