General

  • Target

    ad237ef4b075fcacb74082bffd0839e3ef4eacb932659f2f5a2fee75848e2070N

  • Size

    137KB

  • Sample

    241031-l3hmxawfqr

  • MD5

    b84b06d72ab1835b0c306cc8dfb21f60

  • SHA1

    0fc8e5b372a82dcf057267af3e3663e62233a9f0

  • SHA256

    ad237ef4b075fcacb74082bffd0839e3ef4eacb932659f2f5a2fee75848e2070

  • SHA512

    b7c338ee720183f5ff8b6766371b6c0ef320f25dffb9443982e301c4d38f2274e45a94f049c3d0636a6570764b2967d8da927b6c34c714506cc6a312f8c6523b

  • SSDEEP

    3072:BR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUue:M25GgFny61mrac

Malware Config

Targets

    • Target

      ad237ef4b075fcacb74082bffd0839e3ef4eacb932659f2f5a2fee75848e2070N

    • Size

      137KB

    • MD5

      b84b06d72ab1835b0c306cc8dfb21f60

    • SHA1

      0fc8e5b372a82dcf057267af3e3663e62233a9f0

    • SHA256

      ad237ef4b075fcacb74082bffd0839e3ef4eacb932659f2f5a2fee75848e2070

    • SHA512

      b7c338ee720183f5ff8b6766371b6c0ef320f25dffb9443982e301c4d38f2274e45a94f049c3d0636a6570764b2967d8da927b6c34c714506cc6a312f8c6523b

    • SSDEEP

      3072:BR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUue:M25GgFny61mrac

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    • Sets service image path in registry

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks