General
-
Target
594af9596fa3f327af9fde85f37b52edb3c6cc06448e32d4f88b51c4bf63745a
-
Size
1.2MB
-
Sample
241222-yf4m3sxjbt
-
MD5
f8d71e7a84e2ad07e257446337c91793
-
SHA1
521db55f9a91393dea72a6c39f2beacce545bbae
-
SHA256
594af9596fa3f327af9fde85f37b52edb3c6cc06448e32d4f88b51c4bf63745a
-
SHA512
f253424165bf90d826072afda598bfb3c7e41e92dd90d55cfc2d1551f68fa857c9a64528e37286dd771cdba30a400e3f31fcfef41ab93c9b6c228a19f84f7259
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtii:WIwgMEuy+inDfp3/XoCw57XYBwKi
Behavioral task
behavioral1
Sample
594af9596fa3f327af9fde85f37b52edb3c6cc06448e32d4f88b51c4bf63745a.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
594af9596fa3f327af9fde85f37b52edb3c6cc06448e32d4f88b51c4bf63745a
-
Size
1.2MB
-
MD5
f8d71e7a84e2ad07e257446337c91793
-
SHA1
521db55f9a91393dea72a6c39f2beacce545bbae
-
SHA256
594af9596fa3f327af9fde85f37b52edb3c6cc06448e32d4f88b51c4bf63745a
-
SHA512
f253424165bf90d826072afda598bfb3c7e41e92dd90d55cfc2d1551f68fa857c9a64528e37286dd771cdba30a400e3f31fcfef41ab93c9b6c228a19f84f7259
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtii:WIwgMEuy+inDfp3/XoCw57XYBwKi
-
Gh0st RAT payload
-
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory
-
Server Software Component: Terminal Services DLL
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2