General
- Target MALZ6.zip
- Size 17.8MB
- Sample241207-xc951stkfr
- SHA256 c858e10e29b769ca86445ba1bebdf708e88245da4e96c4afc967818e8293e099
Malware Config
Targets
-
- Target UDP.exe
- Size 31KB
- SHA256 f73a89b6a5c42d21ee4f7a4d79ad784cdfd896bbe2453b60cf9688786f7a9d98
Score3/10 -
- Target a
- Size 1.3MB
- SHA256 dd77459b8d76d9be75dde3f2aa8e8434b266bc98acd15966c6ae65a6620b10db
Score1/10 -
- Target arm1
- Size 977KB
- SHA256 8366aea8087a354cbd178f920770b35d785f988ec3649bb7e282d1e3272a6b77
Score1/10 -
- Target bj.exe
- Size 378KB
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
- Target bjyk.exe
- Size 378KB
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
- Target cctv.exe
- Size 221KB
- SHA256 744d37a30b3e0085b55fb62c9f226a4fd42a2545bd246105ba5e99c8fbfe1011
Score10/10-
Modifies firewall policy service
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Loads dropped DLL
-
- Target cctv_2.exe
- Size 48KB
- SHA256 71ef7e43615e286a5d424d2bafca90c03b05a1c216f1b3ac81997ee2d6bda8d7
Score10/10-
Modifies firewall policy service
-
- Target cn.exe
- Size 520KB
- SHA256 5b81c2781d2c953f46fa7fdd815a31eebdaf8d402ab96457814cdf87583eaf1d
Score7/10-
Executes dropped EXE
-
- Target cn1.exe
- Size 196KB
- SHA256 fe23577d1480bedcd63037921bbd5a55e86171c1a7dc97667df6a674ca0044fc
Score3/10 -
- Target dhl.exe
- Size 378KB
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
- Target java
- Size 1.5MB
- SHA256 59755333ce8c0e16e45340984a22a50f4cb6cb92f8fb85e452dfbec7596a4859
Score1/10 -
- Target java (2)
- Size 41KB
- SHA256 18b0893f3b143a70dc60b0d4da10b63f5fd172fedb63b857b281e0c19a0b0dbe
Score1/10 -
- Target java1
- Size 1.5MB
- SHA256 fc10540c1effe99bdd7a9e1025bdda6813f5dbbdb6e89acdbf79df443a5bba49
Score1/10 -
- Target k5.exe
- Size 76KB
- SHA256 ed989d9d7e04a312dffe2fdd8dd30273d5b07ee56941f1a724b6143752ef42da
Score10/10-
Modifies firewall policy service
-
Modifies RDP port number used by Windows
-
Executes dropped EXE
-
- Target ly1
- Size 745KB
- SHA256 fe686bb110b6af61f109de5b71239bb76ea75e0588ece3a0570393f310eb1026
Score1/10 -
- Target mh.exe
- Size 92KB
- SHA256 22e44f753597c056b7b1eba9728043e7e6dbdf94f0f66f06e6bdd1fdba096fb2
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Modifies firewall policy service
-
Executes dropped EXE
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target mips
- Size 1.1MB
- SHA256 5d9f4ec734cf44f342a45f7de4ba0e208ec141ce47e32b3bc7d0666eff538fe5
Score1/10 -
- Target pjhxx
- Size 544KB
- SHA256 609a5f0e44f1723d29f258c4459a532b75c9c1b2bd26607384d17352150dd3a6
Score1/10 -
- Target rootkit
- Size 357KB
- SHA256 548d1e891b2837e28c6e495fd1e5788ab650d169c53ade1f0cadf005d8657316
Score1/10 -
- Target se.exe
- Size 96KB
- SHA256 589b185221797c8dc67bc586f8c2e3c463a06771e53744afa082c04be7fe5763
Score7/10-
Executes dropped EXE
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
- Target server.exe
- Size 378KB
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
- Target smss.exe
- Size 260KB
- SHA256 20105bd3112e1467d5081400343a6c4baa915c12012db77fadddd5a84e7a0b75
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Modifies firewall policy service
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Ramnit family
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target sqlrer
- Size 1.5MB
- SHA256 fb678d38d8b75262a123a71f5568ed872ecd92a2e3fa38cdf7a8b22031f982db
Score1/10 -
- Target squld
- Size 1.1MB
- SHA256 0d84c93d895c48a00aacf0dbc0565ebde3ab720badf5eff0d85c43aa29027835
Score1/10 -
- Target ssh.sh
- Size 747B
- SHA256 af0e78daa3ef5fec5084820ef80c12f88a2779b9c1ae3f57dda7fc93e033715f
Score3/10 -
- Target taskmgr.exe
- Size 288KB
- SHA256 554c68f17fb687c3941f0cc2b141e25541d1ce66e47ad512d7cfd80f3ea5c026
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Executes dropped EXE
-
Adds Run key to start application
-
- Target win.exe
- Size 133KB
- SHA256 9754217d0fdfb2e06982be84ea1a13dc29ad50a2c5bfd33ae5a14de1fd9568c6
Score10/10-
Modifies firewall policy service
-
UAC bypass
-
Windows security bypass
-
Windows security modification
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
- Target wm
- Size 8KB
- SHA256 45d821a50bb23a092cf136fd79f151abef502f8735ec80d6118b769f98d4326e
Score4/10 -
- Target wrt1
- Size 1.1MB
- SHA256 f309a43e4c8ea82cb5569a9656640e4501a3c0700c1352adb9f788dcef4f2ae1
Score1/10 -
- Target xm.exe
- Size 38KB
- SHA256 d28b2cbecf6d771d85551b357b72c9aa939a57fdc74aee1ebc63ba334ed1e7df
Score10/10-
Modifies firewall policy service
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target yk.exe
- Size 378KB
- SHA256 ca89debe5dff34c2e2f56875d7dcde5e47565329d3aeb2f2f4a6a3e2248fe664
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-
- Target yk1.exe
- Size 184KB
- SHA256 5ecc331e0704bb6756aaacc19bd3d356d9c6851819c18df5be8ef76ba46cde95
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Modifies firewall policy service
-
Executes dropped EXE
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
1File Deletion
1Modify Registry
6