Overview

overview

10

Static

static

3

36357c233b...fN.exe

windows7-x64

10

36357c233b...fN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36357c233bd35d454225ef28512b20a3524275fcbabab9a12ea47c06a9f275ffN.exe

  • Size

    192KB

  • Sample

    241114-c4kdfssnf1

  • MD5

    346873bdfb4f76c290b9a5659b407890

  • SHA1

    a2b473ad5b8a0b2b59521d6e1f3552223bec4dc8

  • SHA256

    36357c233bd35d454225ef28512b20a3524275fcbabab9a12ea47c06a9f275ff

  • SHA512

    6e0ed6262e73e92fda7feed3f1d70a6371d7b93dde57571a33a2c26b6d97d0eed4d992c0976371fcef22904aa124a34b5b581bac88c6d2b05ea72c48b015fd4f

  • SSDEEP

    3072:fZYhjFTttfP9ZGFwgvRLLCzOYFDq+UdnIPPlMzcsofIw+KaX0LcHLkMIIRn:BYhhT96wgvRHCzOYtqlGyzcsX3KA0LQd

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      36357c233bd35d454225ef28512b20a3524275fcbabab9a12ea47c06a9f275ffN.exe

    • Size

      192KB

    • MD5

      346873bdfb4f76c290b9a5659b407890

    • SHA1

      a2b473ad5b8a0b2b59521d6e1f3552223bec4dc8

    • SHA256

      36357c233bd35d454225ef28512b20a3524275fcbabab9a12ea47c06a9f275ff

    • SHA512

      6e0ed6262e73e92fda7feed3f1d70a6371d7b93dde57571a33a2c26b6d97d0eed4d992c0976371fcef22904aa124a34b5b581bac88c6d2b05ea72c48b015fd4f

    • SSDEEP

      3072:fZYhjFTttfP9ZGFwgvRLLCzOYFDq+UdnIPPlMzcsofIw+KaX0LcHLkMIIRn:BYhhT96wgvRHCzOYtqlGyzcsX3KA0LQd

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks