General

  • Target

    449a7432331f5852f25220d79b6311bfa45793e21e73fe13cd6ed1e250309228N

  • Size

    137KB

  • Sample

    241030-j3ym1sxrgy

  • MD5

    01bcc470c03772779c9b008264276060

  • SHA1

    cb5bf36079df9038ac4ca01e6869b0b613102f52

  • SHA256

    449a7432331f5852f25220d79b6311bfa45793e21e73fe13cd6ed1e250309228

  • SHA512

    d7f53a06d96618e7f70d33de529c8c6b783c915a9fe49fe4e65c91be848a973a3778ed2294c97e95870cbe98a723243c836564dcc3e2e908ff541ffe027f5b0f

  • SSDEEP

    3072:VR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuU:425GgFny61mram

Malware Config

Targets

    • Target

      449a7432331f5852f25220d79b6311bfa45793e21e73fe13cd6ed1e250309228N

    • Size

      137KB

    • MD5

      01bcc470c03772779c9b008264276060

    • SHA1

      cb5bf36079df9038ac4ca01e6869b0b613102f52

    • SHA256

      449a7432331f5852f25220d79b6311bfa45793e21e73fe13cd6ed1e250309228

    • SHA512

      d7f53a06d96618e7f70d33de529c8c6b783c915a9fe49fe4e65c91be848a973a3778ed2294c97e95870cbe98a723243c836564dcc3e2e908ff541ffe027f5b0f

    • SSDEEP

      3072:VR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuU:425GgFny61mram

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    • Sets service image path in registry

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks