General

  • Target

    04ef68cd7f95e7cbe8a5f29ac27570d05425f0404ab819a2fa3edb5067ec8b17

  • Size

    137KB

  • Sample

    250127-xxqbcaspgl

  • MD5

    2338763483313f4469d83c96a61a2800

  • SHA1

    e4443981eae80a46d2e487917e75d48d98ac3d25

  • SHA256

    04ef68cd7f95e7cbe8a5f29ac27570d05425f0404ab819a2fa3edb5067ec8b17

  • SHA512

    a6e482391aee86c588a84a335eac1bfeb53db6ff7548d09e0aa476ab45e874e76e6d862bb3d50ebe87237e19370f38530da6f4aed8c94cb1adc83c710bfc78d6

  • SSDEEP

    3072:xR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuQ:c25GgFny61mrau

Malware Config

Targets

    • Target

      04ef68cd7f95e7cbe8a5f29ac27570d05425f0404ab819a2fa3edb5067ec8b17

    • Size

      137KB

    • MD5

      2338763483313f4469d83c96a61a2800

    • SHA1

      e4443981eae80a46d2e487917e75d48d98ac3d25

    • SHA256

      04ef68cd7f95e7cbe8a5f29ac27570d05425f0404ab819a2fa3edb5067ec8b17

    • SHA512

      a6e482391aee86c588a84a335eac1bfeb53db6ff7548d09e0aa476ab45e874e76e6d862bb3d50ebe87237e19370f38530da6f4aed8c94cb1adc83c710bfc78d6

    • SSDEEP

      3072:xR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUuQ:c25GgFny61mrau

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • Boot or Logon Autostart Execution: Port Monitors

      Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    • Sets service image path in registry

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks