General
-
Target
46a725469b8f9378b8ad8e435976ef487085da5cca37b037f3909f516c8e84d5
-
Size
1.2MB
-
Sample
241223-dafc3svmej
-
MD5
f6829c7bf7293492bde6809e2cefb5a2
-
SHA1
4b4a07ea99f07b7f4ba241782d5deca87852cf3b
-
SHA256
46a725469b8f9378b8ad8e435976ef487085da5cca37b037f3909f516c8e84d5
-
SHA512
d5bb2cc3ce1e4e393103f3f48d397d19349767e733efee8136e754907528d7f6ab393729a336ad86fe07bb7e068cc7d81816e3743bb08466c37244a26f174d1e
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiR:WIwgMEuy+inDfp3/XoCw57XYBwKR
Behavioral task
behavioral1
Sample
46a725469b8f9378b8ad8e435976ef487085da5cca37b037f3909f516c8e84d5.exe
Resource
win7-20241010-en
Malware Config
Targets
-
-
Target
46a725469b8f9378b8ad8e435976ef487085da5cca37b037f3909f516c8e84d5
-
Size
1.2MB
-
MD5
f6829c7bf7293492bde6809e2cefb5a2
-
SHA1
4b4a07ea99f07b7f4ba241782d5deca87852cf3b
-
SHA256
46a725469b8f9378b8ad8e435976ef487085da5cca37b037f3909f516c8e84d5
-
SHA512
d5bb2cc3ce1e4e393103f3f48d397d19349767e733efee8136e754907528d7f6ab393729a336ad86fe07bb7e068cc7d81816e3743bb08466c37244a26f174d1e
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtiR:WIwgMEuy+inDfp3/XoCw57XYBwKR
-
Gh0st RAT payload
-
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory
-
Server Software Component: Terminal Services DLL
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2