gh0strat | 53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122 | Triage

Submit
Reports

Overview

overview

Static

static

53508f61db...22.exe

windows7-x64

53508f61db...22.exe

windows10-2004-x64

Sharing

General

Target

53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122
Size

912KB
Sample

250127-2dfd9axnfv
MD5

0b85ac4c10be2180e1d53fb363dfa0f0
SHA1

1bf103469014b2a20d46a3b9e0d9ede0108dd44a
SHA256

53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122
SHA512

65c6d586524cb4d8c2dba4661c4b7b3592d57b74b4241280e8f9217ee82287bdbf8b75054b77183e04759a0c9c60544644ca2a40484d032f659cdea58354a118
SSDEEP

24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWT/:RPjOa1NxyYtH1/

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe

Resource

win7-20240903-en

gh0strat discovery persistence rat

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122.exe

Resource

win10v2004-20241007-en

gh0strat discovery persistence rat

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122
- Size
  
  912KB
- MD5
  
  0b85ac4c10be2180e1d53fb363dfa0f0
- SHA1
  
  1bf103469014b2a20d46a3b9e0d9ede0108dd44a
- SHA256
  
  53508f61dba0fc266e5f708d298d6de92445c2b89a977b5af148b991ead7c122
- SHA512
  
  65c6d586524cb4d8c2dba4661c4b7b3592d57b74b4241280e8f9217ee82287bdbf8b75054b77183e04759a0c9c60544644ca2a40484d032f659cdea58354a118
- SSDEEP
  
  24576:ouLwoR5RNPjKoOAeh0PpS6NxNnwYeOHXAhWT/:RPjOa1NxyYtH1/
Score

10^/10

gh0strat discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoverypersistencerat

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2025

Terms | Privacy