Extracted

• • Target

    8a0adc21da0f4460d73bc875d75c6c1708f0c95d493b4fcc32c34008eefd3cfe

  • Size

    408KB

  • MD5

    f4378da7594eae7da42cbfdef392edbf

  • SHA1

    f4ac310ef1378d4d9deabb48fdf162d2c546f0ef

  • SHA256

    8a0adc21da0f4460d73bc875d75c6c1708f0c95d493b4fcc32c34008eefd3cfe

  • SHA512

    66c2d80b891df386b13c77ad7e04731de93c3a56af155c2a23b00fe15defd98b78c1944e039c7b714be677de41eeaece8463f87a33ac9c7c8223653fdc74221c

  • SSDEEP

    6144:6NyLEbWaR5Cc5iXVrXKVRl6zVH+DOEFEDMw7PvP2aCnt:aUaWaR5voXVr6J6zVIKv+t

  Score

  10^/10

  gh0stratramnitbankerdiscoveryratspywarestealertrojanupxwormpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2