gh0strat | a200023b3ff5786e5e4d90ff8fb355a4bbbe052861871e29a361d2d04233da78 | Triage

Submit
Reports

Overview

overview

Static

static

3

a200023b3f...8N.exe

windows7-x64

a200023b3f...8N.exe

windows10-2004-x64

Sharing

General

Target

a200023b3ff5786e5e4d90ff8fb355a4bbbe052861871e29a361d2d04233da78N.exe
Size

328KB
Sample

241231-eyhnsaxlex
MD5

547b878574ddb23538a8d3409ce702b0
SHA1

ede7adac69f17ed846624c8942e5bdf5a737b164
SHA256

a200023b3ff5786e5e4d90ff8fb355a4bbbe052861871e29a361d2d04233da78
SHA512

966d6b8d7b91f2195e575ff175f718bf66de61830752e88d0f23956c4dbb9069e11002496bb5c31a21bb651687257994d0b28d7bae937fb46fb62f45bf055e90
SSDEEP

6144:4eKKtlCCp1fBpzhhh2KNZbBKKKrx90J8GtiU67+arHM:hlBpBBpcKwnON6Cars

Score

10^/10

gh0strat ramnit banker discovery persistence rat spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a200023b3ff5786e5e4d90ff8fb355a4bbbe052861871e29a361d2d04233da78N.exe

Resource

win7-20241010-en

gh0strat ramnit banker discovery rat spyware stealer trojan upx worm

windows7-x64

21 signatures

120 seconds

Behavioral task

behavioral2

Sample

a200023b3ff5786e5e4d90ff8fb355a4bbbe052861871e29a361d2d04233da78N.exe

Resource

win10v2004-20241007-en

gh0strat ramnit banker discovery persistence rat spyware stealer trojan upx worm

windows10-2004-x64

15 signatures

120 seconds

Malware Config

Targets

- Target
  
  a200023b3ff5786e5e4d90ff8fb355a4bbbe052861871e29a361d2d04233da78N.exe
- Size
  
  328KB
- MD5
  
  547b878574ddb23538a8d3409ce702b0
- SHA1
  
  ede7adac69f17ed846624c8942e5bdf5a737b164
- SHA256
  
  a200023b3ff5786e5e4d90ff8fb355a4bbbe052861871e29a361d2d04233da78
- SHA512
  
  966d6b8d7b91f2195e575ff175f718bf66de61830752e88d0f23956c4dbb9069e11002496bb5c31a21bb651687257994d0b28d7bae937fb46fb62f45bf055e90
- SSDEEP
  
  6144:4eKKtlCCp1fBpzhhh2KNZbBKKKrx90J8GtiU67+arHM:hlBpBBpcKwnON6Cars
Score

10^/10

gh0strat ramnit banker discovery rat spyware stealer trojan upx worm persistence
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratramnitbankerdiscoveryratspywarestealertrojanupxworm

behavioral2

gh0stratramnitbankerdiscoverypersistenceratspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy