gh0strat | f92dca5c589b18788810580ea5eea3df92bd0ba9784ea3f70092f29415395f1b | Triage

Submit
Reports

Overview

overview

Static

static

3

f92dca5c58...1b.exe

windows7-x64

f92dca5c58...1b.exe

windows10-2004-x64

Sharing

General

Target

f92dca5c589b18788810580ea5eea3df92bd0ba9784ea3f70092f29415395f1b
Size

4.8MB
Sample

241111-tz2klszqfs
MD5

e2a2e613a4090da64092041bfa7c81a4
SHA1

2219e4cac81a3634aa875871dcb22bf54ab0c123
SHA256

f92dca5c589b18788810580ea5eea3df92bd0ba9784ea3f70092f29415395f1b
SHA512

e31299e0c90529c4e5ec053ff3c42f5caf29206e6e37f919b16ef489e22bb876e5d6a01e6dbaa38c9069de700610e7b46e17fef97e95fa3381ac36b2a12f03d3
SSDEEP

49152:kYREXSVMDi3F+VbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27z:d2SVMD8F+VbXsPN5kiQaZ56

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f92dca5c589b18788810580ea5eea3df92bd0ba9784ea3f70092f29415395f1b.exe

Resource

win7-20240903-en

gh0strat discovery persistence rat

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

f92dca5c589b18788810580ea5eea3df92bd0ba9784ea3f70092f29415395f1b.exe

Resource

win10v2004-20241007-en

gh0strat discovery persistence rat

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  f92dca5c589b18788810580ea5eea3df92bd0ba9784ea3f70092f29415395f1b
- Size
  
  4.8MB
- MD5
  
  e2a2e613a4090da64092041bfa7c81a4
- SHA1
  
  2219e4cac81a3634aa875871dcb22bf54ab0c123
- SHA256
  
  f92dca5c589b18788810580ea5eea3df92bd0ba9784ea3f70092f29415395f1b
- SHA512
  
  e31299e0c90529c4e5ec053ff3c42f5caf29206e6e37f919b16ef489e22bb876e5d6a01e6dbaa38c9069de700610e7b46e17fef97e95fa3381ac36b2a12f03d3
- SSDEEP
  
  49152:kYREXSVMDi3F+VbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27z:d2SVMD8F+VbXsPN5kiQaZ56
Score

10^/10

gh0strat discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Server Software Component: Terminal Services DLL
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoverypersistencerat

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2024

Terms | Privacy