General

  • Target

    1a0aacd39871a97963010f16627c898bc7edfce1592ab6e83b4c4bd96afc88a7N

  • Size

    137KB

  • Sample

    241030-ke2kfa1lcm

  • MD5

    2909a2c4a6cdd5a9e24e43ba28854d00

  • SHA1

    18b7bf42869b8937124229721fef69bd3aa1cf1c

  • SHA256

    1a0aacd39871a97963010f16627c898bc7edfce1592ab6e83b4c4bd96afc88a7

  • SHA512

    7f3491b3a1cf22c90f605ce6a5025c90dfb9f8f3a8b1780cae35ad55187482fc5dd484ae74e500c2997b98468dfc98d4558c5979c4f9d9cf6d27d075f1ac18a2

  • SSDEEP

    3072:KR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuU:f25GgFny61mray

Malware Config

Targets

    • Target

      1a0aacd39871a97963010f16627c898bc7edfce1592ab6e83b4c4bd96afc88a7N

    • Size

      137KB

    • MD5

      2909a2c4a6cdd5a9e24e43ba28854d00

    • SHA1

      18b7bf42869b8937124229721fef69bd3aa1cf1c

    • SHA256

      1a0aacd39871a97963010f16627c898bc7edfce1592ab6e83b4c4bd96afc88a7

    • SHA512

      7f3491b3a1cf22c90f605ce6a5025c90dfb9f8f3a8b1780cae35ad55187482fc5dd484ae74e500c2997b98468dfc98d4558c5979c4f9d9cf6d27d075f1ac18a2

    • SSDEEP

      3072:KR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuU:f25GgFny61mray

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    • Sets service image path in registry

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks