Overview

overview

10

Static

static

3

ddc20ff6fc...aN.dll

windows7-x64

8

ddc20ff6fc...aN.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ddc20ff6fcc9bdf41c1b4f0c0c2d49084b67190c0c8e261787ca42c517b1e3caN.exe

  • Size

    137KB

  • Sample

    250127-j18p7sypf1

  • MD5

    5acbcc15a83b3b6c113cb167d5c9a140

  • SHA1

    00085aac06366f8cbd0c0b4258b8b0ea7c6a7494

  • SHA256

    ddc20ff6fcc9bdf41c1b4f0c0c2d49084b67190c0c8e261787ca42c517b1e3ca

  • SHA512

    1161b0e6f5aa5097714e5589a9729fe912516359a025efd5e9a8fdf9d6d8c06ab5ba19c92d21b0e3cf04b5d5417ff4d65615572afa6303e1671eae401e05c54b

  • SSDEEP

    3072:1R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuD:Y25GgFny61mraZ

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      ddc20ff6fcc9bdf41c1b4f0c0c2d49084b67190c0c8e261787ca42c517b1e3caN.exe

    • Size

      137KB

    • MD5

      5acbcc15a83b3b6c113cb167d5c9a140

    • SHA1

      00085aac06366f8cbd0c0b4258b8b0ea7c6a7494

    • SHA256

      ddc20ff6fcc9bdf41c1b4f0c0c2d49084b67190c0c8e261787ca42c517b1e3ca

    • SHA512

      1161b0e6f5aa5097714e5589a9729fe912516359a025efd5e9a8fdf9d6d8c06ab5ba19c92d21b0e3cf04b5d5417ff4d65615572afa6303e1671eae401e05c54b

    • SSDEEP

      3072:1R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuD:Y25GgFny61mraZ

    Score
    10/10
    discoverypersistencegh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

      persistence

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks