Extracted

Extracted

• • Target

    70c7339ea2fe122044db3a7a5e68a91404181c812558d626078c5f80810b999e.exe

  • Size

    112KB

  • MD5

    5ad597debc3825883758cb4771dde705

  • SHA1

    3ca5c9f6ba65a02dc99bfa677706f695772f49b7

  • SHA256

    70c7339ea2fe122044db3a7a5e68a91404181c812558d626078c5f80810b999e

  • SHA512

    ed3f6bbb5b4c0e79926e987d4ebcbbc7adcbe4833000bc607a210e5883e1e915b909fb0695fba9dcc762c4807dac7cc4adff75b423e8646467aea7f8a12dcabb

  • SSDEEP

    1536:vqEA70HzLJksPEOajozLElnqiO2Z+dJ/tHi:vXTLJkQ7zAV3ZUtC

  Score

  10^/10

  gh0stratdiscoverypersistencerat

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2