gh0strat | 2e8a6d8e3f5e6fe16ba30fade1d097383fd8a408bd87220ed386ac61b3b7e79e | Triage

Resubmissions

28/02/2025, 07:53

250228-jq9jrawmv9 10

28/02/2025, 07:46

250228-jl5p1awlw9 10

Sharing

General

Target

JaffaCakes118_3293e67122b2a0f8bcdfb4bbc6576ac2
Size

107KB
Sample

250228-jq9jrawmv9
MD5

3293e67122b2a0f8bcdfb4bbc6576ac2
SHA1

bf3b11eca3ef68b591755febec08b189a27cf691
SHA256

2e8a6d8e3f5e6fe16ba30fade1d097383fd8a408bd87220ed386ac61b3b7e79e
SHA512

67d7b102077fe0f20ba502d45da7ec428322b9d0829e278483bd36ddfad925a2903c25c1bcc008954a4cd9b0eda68d7d1987edd2c1e022dbf1c7e813cce56c14
SSDEEP

1536:DbAJjSaBsyZ++i5FyV6pxPpzUsLSpc6P2fcOi1jToKAoSwzkK8:DbAJjS4lUZga5SppPgcOidToKAoSwQK8

Score

10^/10

gh0strat android defense_evasion discovery execution linux macos persistence rat

Malware Config

Targets

- Target
  
  JaffaCakes118_3293e67122b2a0f8bcdfb4bbc6576ac2
- Size
  
  107KB
- MD5
  
  3293e67122b2a0f8bcdfb4bbc6576ac2
- SHA1
  
  bf3b11eca3ef68b591755febec08b189a27cf691
- SHA256
  
  2e8a6d8e3f5e6fe16ba30fade1d097383fd8a408bd87220ed386ac61b3b7e79e
- SHA512
  
  67d7b102077fe0f20ba502d45da7ec428322b9d0829e278483bd36ddfad925a2903c25c1bcc008954a4cd9b0eda68d7d1987edd2c1e022dbf1c7e813cce56c14
- SSDEEP
  
  1536:DbAJjSaBsyZ++i5FyV6pxPpzUsLSpc6P2fcOi1jToKAoSwzkK8:DbAJjS4lUZga5SppPgcOidToKAoSwQK8
Score

10^/10

gh0strat discovery rat defense_evasion execution persistence
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
behavioral1 behavioral10 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Privilege Escalation

Create or Modify System Process

Launch Agent

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoveryrat

behavioral2

gh0stratdiscoveryrat

behavioral3

behavioral4

behavioral5

behavioral6

defense_evasionexecutionpersistence

behavioral7

behavioral8

behavioral9

behavioral10