Overview

overview

10

Static

static

3

9fdb8a568e...1N.dll

windows7-x64

5

9fdb8a568e...1N.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9fdb8a568e8f11d704f818a5d3723a8c0d470e8d8351c72a84c1b77cdb2b79d1N

  • Size

    137KB

  • Sample

    241109-z9plpavqcn

  • MD5

    873f7b0057d35ab411b1699f2e27e440

  • SHA1

    2814cb0c82b2dd6a8ced8f07b01fdae86af3b1a6

  • SHA256

    9fdb8a568e8f11d704f818a5d3723a8c0d470e8d8351c72a84c1b77cdb2b79d1

  • SHA512

    6ef2a0663a92857e64af676ebdc4b09f3df7b6a91a987916d653e8cbe1f1db63873b1bb5225d81f47fbc0925000a9d5c4eb0ecca3e28ff853c10c4d7ea6224d8

  • SSDEEP

    3072:TR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu/:+25GgFny61mraF

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      9fdb8a568e8f11d704f818a5d3723a8c0d470e8d8351c72a84c1b77cdb2b79d1N

    • Size

      137KB

    • MD5

      873f7b0057d35ab411b1699f2e27e440

    • SHA1

      2814cb0c82b2dd6a8ced8f07b01fdae86af3b1a6

    • SHA256

      9fdb8a568e8f11d704f818a5d3723a8c0d470e8d8351c72a84c1b77cdb2b79d1

    • SHA512

      6ef2a0663a92857e64af676ebdc4b09f3df7b6a91a987916d653e8cbe1f1db63873b1bb5225d81f47fbc0925000a9d5c4eb0ecca3e28ff853c10c4d7ea6224d8

    • SSDEEP

      3072:TR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu/:+25GgFny61mraF

    Score
    10/10
    discoverygh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

      persistence

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks