General
-
Target
500be4f476a6e64002c2cc0df19c91b409ab94d63d0e41983d881c9348f91f70
-
Size
137KB
-
Sample
250302-25el2aytay
-
MD5
48c25c8febbe92e9329f8b6995950f05
-
SHA1
9ac0827456cb3214409d758ec88b943812036217
-
SHA256
500be4f476a6e64002c2cc0df19c91b409ab94d63d0e41983d881c9348f91f70
-
SHA512
00607438bdd868dc30cf83c3cd414d50069b7229d0099b564fab30fc3389ad4130a680ddc6b21667aebf68dddb04a28b3dd2a858501eb1fff31772643b0330c0
-
SSDEEP
3072:WR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu9:T25GgFny61mraT
Malware Config
Targets
-
-
Target
500be4f476a6e64002c2cc0df19c91b409ab94d63d0e41983d881c9348f91f70
-
Size
137KB
-
MD5
48c25c8febbe92e9329f8b6995950f05
-
SHA1
9ac0827456cb3214409d758ec88b943812036217
-
SHA256
500be4f476a6e64002c2cc0df19c91b409ab94d63d0e41983d881c9348f91f70
-
SHA512
00607438bdd868dc30cf83c3cd414d50069b7229d0099b564fab30fc3389ad4130a680ddc6b21667aebf68dddb04a28b3dd2a858501eb1fff31772643b0330c0
-
SSDEEP
3072:WR02WMK8RJGInTlhnaBanONVk40rpg4yeF/TyUGSK9FrafcUksPxx6iTUu9:T25GgFny61mraT
Score10/10-
Gh0st RAT payload
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Blocklisted process makes network request
-
Boot or Logon Autostart Execution: Port Monitors
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
-
Sets service image path in registry
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Port Monitors
1Registry Run Keys / Startup Folder
1