Extracted

• • Target

    806b77638493b3ff52dbc27f0d2d2257d606cf4f69c2ecb509a4141bdc322b2b

  • Size

    388KB

  • MD5

    5ff4d21d752c9ac5d796d6e52dc3b15d

  • SHA1

    3fad1394f5278c5500ee62d90c0d3df8b1af73e0

  • SHA256

    806b77638493b3ff52dbc27f0d2d2257d606cf4f69c2ecb509a4141bdc322b2b

  • SHA512

    1942b1d9c0467357415c9d93c05186a03adc34a31371131eabb0d7e87da170567c0e835e9d105991d65ec57eaa5116a6e3d21e52661e248b34c5468f760e8e1d

  • SSDEEP

    3072:6yK/yLrQbWaR5Qax8c/YtYfK/tQSX0R9P87q5ECq+SzUPxi+SXxF:6NyLEbWaR5CcFuZoC8ET+S4ZbSXxF

  Score

  10^/10

  gh0stratdiscoveryratpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2