General

  • Target

    9dcb4a0c4c9d56a8edad65e25eee8d663d306f0c754dd4f2dead6047f4c33a5e

  • Size

    899KB

  • Sample

    241110-pysh4axcqh

  • MD5

    deea73d147c5f23b23f6a92c09d3c4b4

  • SHA1

    b47dbe0aa7a6fea30ebf0b3064dc0dd2e3e4d2e4

  • SHA256

    9dcb4a0c4c9d56a8edad65e25eee8d663d306f0c754dd4f2dead6047f4c33a5e

  • SHA512

    5aa44b90cf43d5316be5ff7d80e1881108280585d4a5b35a83e0e72115ec43c58c0db92380d9a2e6da3263839b53819b15f79d2f6dfc5bf278ecf1b5f9c4e7d0

  • SSDEEP

    24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXI:7wqd87VI

Score
10/10

Malware Config

Extracted

Family

gh0strat

C2

hackerinvasion.f3322.net

Targets

    • Target

      9dcb4a0c4c9d56a8edad65e25eee8d663d306f0c754dd4f2dead6047f4c33a5e

    • Size

      899KB

    • MD5

      deea73d147c5f23b23f6a92c09d3c4b4

    • SHA1

      b47dbe0aa7a6fea30ebf0b3064dc0dd2e3e4d2e4

    • SHA256

      9dcb4a0c4c9d56a8edad65e25eee8d663d306f0c754dd4f2dead6047f4c33a5e

    • SHA512

      5aa44b90cf43d5316be5ff7d80e1881108280585d4a5b35a83e0e72115ec43c58c0db92380d9a2e6da3263839b53819b15f79d2f6dfc5bf278ecf1b5f9c4e7d0

    • SSDEEP

      24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXI:7wqd87VI

    Score
    10/10
    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

MITRE ATT&CK Enterprise v15

Tasks