gh0strat | 1950c34174ef5585c0011fe52569447c75b5c22fb4cef5594d17687899eca7da | Triage

Submit
Reports

Overview

overview

Static

static

3

1950c34174...da.exe

windows7-x64

1950c34174...da.exe

windows10-2004-x64

Sharing

General

Target

1950c34174ef5585c0011fe52569447c75b5c22fb4cef5594d17687899eca7da.exe
Size

328KB
Sample

241230-x81lfsvnhn
MD5

791174ec65e2f38632b755a3543cfdea
SHA1

5441097974ffe1614d6d14b53290cda1b4ef682b
SHA256

1950c34174ef5585c0011fe52569447c75b5c22fb4cef5594d17687899eca7da
SHA512

3360cbd5712ffadfb63669e9105c1fa1b75d64c7880f632a30e1d52aa94b20656883e15c9c8130d99f08c84dcaeec71aa1ef698620f16b591ecdb575bbaecd5d
SSDEEP

6144:4eKKtlCCp1fBpzhhh2KNZbBKKKrx90J8GtiU67+arH0:hlBpBBpcKwnON6CarU

Score

10^/10

gh0strat ramnit banker discovery persistence rat spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1950c34174ef5585c0011fe52569447c75b5c22fb4cef5594d17687899eca7da.exe

Resource

win7-20241010-en

gh0strat ramnit banker discovery rat spyware stealer trojan upx worm

windows7-x64

21 signatures

120 seconds

Behavioral task

behavioral2

Sample

1950c34174ef5585c0011fe52569447c75b5c22fb4cef5594d17687899eca7da.exe

Resource

win10v2004-20241007-en

gh0strat ramnit banker discovery persistence rat spyware stealer trojan upx worm

windows10-2004-x64

15 signatures

120 seconds

Malware Config

Targets

- Target
  
  1950c34174ef5585c0011fe52569447c75b5c22fb4cef5594d17687899eca7da.exe
- Size
  
  328KB
- MD5
  
  791174ec65e2f38632b755a3543cfdea
- SHA1
  
  5441097974ffe1614d6d14b53290cda1b4ef682b
- SHA256
  
  1950c34174ef5585c0011fe52569447c75b5c22fb4cef5594d17687899eca7da
- SHA512
  
  3360cbd5712ffadfb63669e9105c1fa1b75d64c7880f632a30e1d52aa94b20656883e15c9c8130d99f08c84dcaeec71aa1ef698620f16b591ecdb575bbaecd5d
- SSDEEP
  
  6144:4eKKtlCCp1fBpzhhh2KNZbBKKKrx90J8GtiU67+arH0:hlBpBBpcKwnON6CarU
Score

10^/10

gh0strat ramnit banker discovery rat spyware stealer trojan upx worm persistence
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratramnitbankerdiscoveryratspywarestealertrojanupxworm

behavioral2

gh0stratramnitbankerdiscoverypersistenceratspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy