Overview

overview

10

Static

static

3

79948de1c3...3N.dll

windows7-x64

8

79948de1c3...3N.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    79948de1c302e8e8da5228d02b349a12d273a1bb31a926ecc45378121b732233N.exe

  • Size

    137KB

  • Sample

    250120-k28bhaskar

  • MD5

    dbca827c5d1561a8fb1e8efb5d945f20

  • SHA1

    43952475cbc756f3b6744b6b230cf986258683d1

  • SHA256

    79948de1c302e8e8da5228d02b349a12d273a1bb31a926ecc45378121b732233

  • SHA512

    e65da0299319e23c7214948aa305db3bc2f45f63f2651fad926da8aeddf4c8f68f59c2d31107e483a481abc3279a0541c73dc300106b0268ade294a7c8646c3f

  • SSDEEP

    3072:BR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuj:M25GgFny61mra5

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      79948de1c302e8e8da5228d02b349a12d273a1bb31a926ecc45378121b732233N.exe

    • Size

      137KB

    • MD5

      dbca827c5d1561a8fb1e8efb5d945f20

    • SHA1

      43952475cbc756f3b6744b6b230cf986258683d1

    • SHA256

      79948de1c302e8e8da5228d02b349a12d273a1bb31a926ecc45378121b732233

    • SHA512

      e65da0299319e23c7214948aa305db3bc2f45f63f2651fad926da8aeddf4c8f68f59c2d31107e483a481abc3279a0541c73dc300106b0268ade294a7c8646c3f

    • SSDEEP

      3072:BR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuj:M25GgFny61mra5

    Score
    10/10
    discoverypersistencegh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

      persistence

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks