General
-
Target
26c1bdfed569159ce8ade627e1ae7f49ac27735482e5e67956bc875e9ebe8a38N.exe
-
Size
137KB
-
Sample
250127-s2t3wawlgp
-
MD5
6104d88fe032378df850355ad139cbd0
-
SHA1
f0302259f1a1c23905a36127d744b426967b2023
-
SHA256
26c1bdfed569159ce8ade627e1ae7f49ac27735482e5e67956bc875e9ebe8a38
-
SHA512
633c328daf49778ad55a73df6be6c85fa7fd7eaa5629b9936642404867fe66bf1374e5d03a37dd8b3120b680cf8909b1c25928323054a150411955ea046fc28f
-
SSDEEP
3072:8R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuX:J25GgFny61mraZ
Malware Config
Targets
-
-
Target
26c1bdfed569159ce8ade627e1ae7f49ac27735482e5e67956bc875e9ebe8a38N.exe
-
Size
137KB
-
MD5
6104d88fe032378df850355ad139cbd0
-
SHA1
f0302259f1a1c23905a36127d744b426967b2023
-
SHA256
26c1bdfed569159ce8ade627e1ae7f49ac27735482e5e67956bc875e9ebe8a38
-
SHA512
633c328daf49778ad55a73df6be6c85fa7fd7eaa5629b9936642404867fe66bf1374e5d03a37dd8b3120b680cf8909b1c25928323054a150411955ea046fc28f
-
SSDEEP
3072:8R02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuX:J25GgFny61mraZ
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Blocklisted process makes network request
-
Boot or Logon Autostart Execution: Port Monitors
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
-
Sets service image path in registry
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1