gh0strat | b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b | Triage

Submit
Reports

Overview

overview

Static

static

3

b8b335c6d6...3b.exe

windows7-x64

b8b335c6d6...3b.exe

windows10-2004-x64

Sharing

General

Target

b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b
Size

1.2MB
Sample

250127-nxpv5sxqdl
MD5

88d155d0b88571ced113631bde43becc
SHA1

40209615a825de70f53f3d1800771ff9319f460e
SHA256

b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b
SHA512

62452ecb7f438a29501135322ae1430d29119c1e5a0d630c258d09f5586a39141ed67dbeadcdee6650efd796a548b9c461433026ae8011f27cc56701655c16dd
SSDEEP

24576:zYFbkIsaPiXSVnC7Yp9zjNmZG8RRl9gyzd2jsS0:zYREXSVMKi3asS0

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe

Resource

win7-20240903-en

gh0strat discovery persistence rat

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b.exe

Resource

win10v2004-20241007-en

gh0strat discovery persistence rat

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b
- Size
  
  1.2MB
- MD5
  
  88d155d0b88571ced113631bde43becc
- SHA1
  
  40209615a825de70f53f3d1800771ff9319f460e
- SHA256
  
  b8b335c6d66f6a6152e9652e1bb4c09770dab8625f49a4a0582556892622bf3b
- SHA512
  
  62452ecb7f438a29501135322ae1430d29119c1e5a0d630c258d09f5586a39141ed67dbeadcdee6650efd796a548b9c461433026ae8011f27cc56701655c16dd
- SSDEEP
  
  24576:zYFbkIsaPiXSVnC7Yp9zjNmZG8RRl9gyzd2jsS0:zYREXSVMKi3asS0
Score

10^/10

gh0strat discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Server Software Component: Terminal Services DLL
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoverypersistencerat

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2025

Terms | Privacy