General

  • Target

    6ecded774085678b12c09caa8980d506123759e2c3224f1052e1c84d8c4442f9

  • Size

    540KB

  • Sample

    241029-zjmpeazblh

  • MD5

    3f5be345140293b45f78f534d0fd26e0

  • SHA1

    674c075d1dc8a848e81974571cde01ffc8623d79

  • SHA256

    6ecded774085678b12c09caa8980d506123759e2c3224f1052e1c84d8c4442f9

  • SHA512

    c328c641f6a28c493d99763461d3e3da515cbeb2fc4bea28ccde306efbfedbc4047b27dfe47c5ea9aabaaa4f3214b161127192e2ba597a3fdf84fc85e5cb9e80

  • SSDEEP

    12288:4Rdy3HCdZyyXlG47Of9daZF+EnBEnAzr+zbSN2RJM:4RqCdZyyXlG4QKiIySN2RK

Score
10/10

Malware Config

Targets

    • Target

      6ecded774085678b12c09caa8980d506123759e2c3224f1052e1c84d8c4442f9

    • Size

      540KB

    • MD5

      3f5be345140293b45f78f534d0fd26e0

    • SHA1

      674c075d1dc8a848e81974571cde01ffc8623d79

    • SHA256

      6ecded774085678b12c09caa8980d506123759e2c3224f1052e1c84d8c4442f9

    • SHA512

      c328c641f6a28c493d99763461d3e3da515cbeb2fc4bea28ccde306efbfedbc4047b27dfe47c5ea9aabaaa4f3214b161127192e2ba597a3fdf84fc85e5cb9e80

    • SSDEEP

      12288:4Rdy3HCdZyyXlG47Of9daZF+EnBEnAzr+zbSN2RJM:4RqCdZyyXlG4QKiIySN2RK

    Score
    10/10
    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks