General

  • Target

    94bc641567e3e522a4989416f8c5249cf99d8ef7e08525793a25f53e4d27cdef

  • Size

    51KB

  • Sample

    241110-p4832azpcq

  • MD5

    f549327dbbcdb3c0456b41f79c7aae3d

  • SHA1

    d3e5facefad3c0c4e0cf1536b01bb4725bec48ec

  • SHA256

    94bc641567e3e522a4989416f8c5249cf99d8ef7e08525793a25f53e4d27cdef

  • SHA512

    4f446240d17f90288cb75f52169f13201537fe1616813710b8f740e069f139b370b90bb62e413a9329e6994e36cea0e0f816cba66644e3b1a434f1b7b5eb36d6

  • SSDEEP

    1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLGJYH5:1dWubF3n9S91BF3fboKJYH5

Score
10/10

Malware Config

Extracted

Family

gh0strat

C2

kinh.xmcxmr.com

Targets

    • Target

      94bc641567e3e522a4989416f8c5249cf99d8ef7e08525793a25f53e4d27cdef

    • Size

      51KB

    • MD5

      f549327dbbcdb3c0456b41f79c7aae3d

    • SHA1

      d3e5facefad3c0c4e0cf1536b01bb4725bec48ec

    • SHA256

      94bc641567e3e522a4989416f8c5249cf99d8ef7e08525793a25f53e4d27cdef

    • SHA512

      4f446240d17f90288cb75f52169f13201537fe1616813710b8f740e069f139b370b90bb62e413a9329e6994e36cea0e0f816cba66644e3b1a434f1b7b5eb36d6

    • SSDEEP

      1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLGJYH5:1dWubF3n9S91BF3fboKJYH5

    Score
    10/10
    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

MITRE ATT&CK Enterprise v15

Tasks