General
-
Target
7f82baa4c1a7086dbb69d527ee5df056ab1fef0a20972e8e0f899a2bc45343bd
-
Size
1.2MB
-
Sample
241110-xb87bssgqe
-
MD5
29de510d47e44cd726481a36f8b41682
-
SHA1
ec19316263148c03df12f9ff246e3ffa7085b836
-
SHA256
7f82baa4c1a7086dbb69d527ee5df056ab1fef0a20972e8e0f899a2bc45343bd
-
SHA512
a693e1639ec4fd8834d91a0e6c2fe3116c2a42d1efd077ea07c49d6f3fa6d65177bd04cf42844ccd12576b832c857c0fe373dc8536f91e8fa8dbb5125004002f
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiI:WIwgMEuy+inDfp3/XoCw57XYBwKI
Behavioral task
behavioral1
Sample
7f82baa4c1a7086dbb69d527ee5df056ab1fef0a20972e8e0f899a2bc45343bd.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
7f82baa4c1a7086dbb69d527ee5df056ab1fef0a20972e8e0f899a2bc45343bd
-
Size
1.2MB
-
MD5
29de510d47e44cd726481a36f8b41682
-
SHA1
ec19316263148c03df12f9ff246e3ffa7085b836
-
SHA256
7f82baa4c1a7086dbb69d527ee5df056ab1fef0a20972e8e0f899a2bc45343bd
-
SHA512
a693e1639ec4fd8834d91a0e6c2fe3116c2a42d1efd077ea07c49d6f3fa6d65177bd04cf42844ccd12576b832c857c0fe373dc8536f91e8fa8dbb5125004002f
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiI:WIwgMEuy+inDfp3/XoCw57XYBwKI
-
Gh0st RAT payload
-
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory
-
Server Software Component: Terminal Services DLL
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2