Extracted

Extracted

• • Target

    5c15dfb77e6ebf777995de8713092d59d857adadc12a0fd4457eb3e75a385735N.exe

  • Size

    112KB

  • MD5

    df4cab6655d82482c76d0510392e1fb0

  • SHA1

    ebe7c66ab923db14d9bcfee88cd357eeb4b55c87

  • SHA256

    5c15dfb77e6ebf777995de8713092d59d857adadc12a0fd4457eb3e75a385735

  • SHA512

    3f205583b99a4237b28c66514abfc0866e6365bff0a4bbfc85f57b0e112887cc493bd7fea6c54dd884833491a1e70e84b90fcb4e7aff678cea75f8e161385dbd

  • SSDEEP

    1536:vqEA70HzLJksPEOajozLElnqiO2Z+dJ/tH:vXTLJkQ7zAV3ZUt

  Score

  10^/10

  gh0stratdiscoverypersistencerat

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2