Overview

overview

10

Static

static

3

7f0ba1ca44...ab.dll

windows7-x64

8

7f0ba1ca44...ab.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7f0ba1ca440d4a0485aba863a818a07412bf1d484e4030dbb29785ef7ea95cab.exe

  • Size

    137KB

  • Sample

    250127-mp3atswjbr

  • MD5

    7a32dca74c10c5d5fbdb839a010f4d7b

  • SHA1

    ee0efe5c793978cff54fdb3e8992ce1515da0ab5

  • SHA256

    7f0ba1ca440d4a0485aba863a818a07412bf1d484e4030dbb29785ef7ea95cab

  • SHA512

    94f12750d257936df58afa98b505b1aa97046d34caa54a08bf78ac0f7425c02145b43333592cf274c7821f0679052601120b561437ffdff02980ac9d841aa1c3

  • SSDEEP

    3072:8R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuv:J25GgFny61mraB

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      7f0ba1ca440d4a0485aba863a818a07412bf1d484e4030dbb29785ef7ea95cab.exe

    • Size

      137KB

    • MD5

      7a32dca74c10c5d5fbdb839a010f4d7b

    • SHA1

      ee0efe5c793978cff54fdb3e8992ce1515da0ab5

    • SHA256

      7f0ba1ca440d4a0485aba863a818a07412bf1d484e4030dbb29785ef7ea95cab

    • SHA512

      94f12750d257936df58afa98b505b1aa97046d34caa54a08bf78ac0f7425c02145b43333592cf274c7821f0679052601120b561437ffdff02980ac9d841aa1c3

    • SSDEEP

      3072:8R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuv:J25GgFny61mraB

    Score
    10/10
    discoverypersistencegh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Blocklisted process makes network request

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

      persistence

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks