General

  • Target

    b3e229eca59895e295d7253a6e025e11cabe1e00c302601f19abd7fe3923a10aN

  • Size

    137KB

  • Sample

    241030-j85zaayjgt

  • MD5

    17adac1b48ec354149a54b02ace5cb90

  • SHA1

    ff30a9ca802dfae61de819e2758f0d0e81c42c14

  • SHA256

    b3e229eca59895e295d7253a6e025e11cabe1e00c302601f19abd7fe3923a10a

  • SHA512

    1fc9fd28bac3bcf04f95d77a10ebf599cc14ddc2d7ca646d3f0bb5128c54b9a32df86260ba35c45e04ed46c4f6ec9ea4433046975e89ca2277bfde1d0fbed925

  • SSDEEP

    3072:KR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuX:f25GgFny61mrax

Malware Config

Targets

    • Target

      b3e229eca59895e295d7253a6e025e11cabe1e00c302601f19abd7fe3923a10aN

    • Size

      137KB

    • MD5

      17adac1b48ec354149a54b02ace5cb90

    • SHA1

      ff30a9ca802dfae61de819e2758f0d0e81c42c14

    • SHA256

      b3e229eca59895e295d7253a6e025e11cabe1e00c302601f19abd7fe3923a10a

    • SHA512

      1fc9fd28bac3bcf04f95d77a10ebf599cc14ddc2d7ca646d3f0bb5128c54b9a32df86260ba35c45e04ed46c4f6ec9ea4433046975e89ca2277bfde1d0fbed925

    • SSDEEP

      3072:KR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuX:f25GgFny61mrax

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    • Sets service image path in registry

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks