Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18/10/2024, 02:11
General
-
Target
6071e5f0aff7e9ca072a6f0d4d224872afe0b59fb86d81c6f10e9be8025f7986.exe
-
Size
125KB
-
MD5
9a008f9db045e30320e4ef30b7d3d6a4
-
SHA1
8eb084fc6ca58a69f5ae221b843d7251256b8487
-
SHA256
6071e5f0aff7e9ca072a6f0d4d224872afe0b59fb86d81c6f10e9be8025f7986
-
SHA512
e5f57d75f801f81b75e3acc7f1cd7017aca2360de0c683f9928938ce62613f887bc71748f41dec2d985b69516e02fb87f6a75104c8491c3697fc97d6d97f43f1
-
SSDEEP
3072:JY/wTle9dJ1OIG5WpnrEIjt9z/wa0Q0z:SwTIHu6oIPzwaD
Malware Config
Extracted
gh0strat
10.177.224.219
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6071e5f0aff7e9ca072a6f0d4d224872afe0b59fb86d81c6f10e9be8025f7986.exe"C:\Users\Admin\AppData\Local\Temp\6071e5f0aff7e9ca072a6f0d4d224872afe0b59fb86d81c6f10e9be8025f7986.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
412KB
-
Filesize
92KB
-
Filesize
412KB