Overview

overview

10

Static

static

3

setups.exe

windows7-x64

10

setups.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_48d02d56b5f35f6dbb5a39c09a3da72e

  • Size

    105KB

  • Sample

    250128-ka6ctstkcr

  • MD5

    48d02d56b5f35f6dbb5a39c09a3da72e

  • SHA1

    b1c3f404f23e2bba133268faf9f0e0a8d480c597

  • SHA256

    3f852c0f09007ea12f110306f3d4d27678032e9082242a8f3d291f4561286f11

  • SHA512

    4f23f68e7695ac234c462ff9ddc78b41ecf3894fdbccffddb530973ab8971f09eef2fd522c3182303b50cc7dd07ab842e2e83d480c9003b9544a16fcc0c721a3

  • SSDEEP

    1536:7wNBnAxOHk2rfM6IMyTHV4NqbCjSmdDB4TlTXlk7gwttXRYeGT8HzW+1JvlbuN9l:EDfE2rkXvBy+ZS4lDJT8TWqJYL

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      setups.exe

    • Size

      22.6MB

    • MD5

      d6437b34d2f4ebc283dba35fa11fec25

    • SHA1

      cf4ede6cff02f7d43362e1a7c87657fa6099842d

    • SHA256

      1a849f51b091f22e8949ca92f5e99482bd3d9202c76fa27afd209f0e21b46bcc

    • SHA512

      02524b129c33b1e2c378fc46d9f1bf98f5422c1b4bac6fae9bbce46cba9a762970dc93a643c41aaefcafe43734fdba3ba8e78227dd559b3c3f135085f31e4cff

    • SSDEEP

      6144:lUrJnWqbUNZFXXp1pvpGFd7XDda328nnnnnnR:qlWqYvMFJUma

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks