General
-
Target
d597e69e64116773827faa3c68de9a694d407778a1921e8b6b5e94cef9f9ceb8N.exe
-
Size
137KB
-
Sample
241113-ps72lasblc
-
MD5
2b2edc515397a4cb230cc8101925d360
-
SHA1
b8b4ccefc206f4ad2f18457ce2b7f6f3b1aeb67c
-
SHA256
d597e69e64116773827faa3c68de9a694d407778a1921e8b6b5e94cef9f9ceb8
-
SHA512
1c93e18a3cb187a26b625451a366ec6661be4344d21daf37d68d0196335fa4eb4aa983c9cbcf9ac6992b9249b2bf72c909d39bb2dceee543f954c860dd4757a0
-
SSDEEP
3072:3R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuQ:K25GgFny61mrae
Malware Config
Targets
-
-
Target
d597e69e64116773827faa3c68de9a694d407778a1921e8b6b5e94cef9f9ceb8N.exe
-
Size
137KB
-
MD5
2b2edc515397a4cb230cc8101925d360
-
SHA1
b8b4ccefc206f4ad2f18457ce2b7f6f3b1aeb67c
-
SHA256
d597e69e64116773827faa3c68de9a694d407778a1921e8b6b5e94cef9f9ceb8
-
SHA512
1c93e18a3cb187a26b625451a366ec6661be4344d21daf37d68d0196335fa4eb4aa983c9cbcf9ac6992b9249b2bf72c909d39bb2dceee543f954c860dd4757a0
-
SSDEEP
3072:3R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuQ:K25GgFny61mrae
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Blocklisted process makes network request
-
Boot or Logon Autostart Execution: Port Monitors
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
-
Sets service image path in registry
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1