gh0strat | 50a7ce05a039f76eaa2f0aa1842a3726ddc140f4dab579968a28ff5f6c284df4 | Triage

Submit
Reports

Overview

overview

Static

static

5

50a7ce05a0...f4.exe

windows7-x64

50a7ce05a0...f4.exe

windows10-2004-x64

Sharing

General

Target

50a7ce05a039f76eaa2f0aa1842a3726ddc140f4dab579968a28ff5f6c284df4
Size

501KB
Sample

250303-h1xgha1qz8
MD5

56386a779a5b1ebdd6c296d30f7165ff
SHA1

10388a3d6f12fe22f97ac541a45c6e20381ecd57
SHA256

50a7ce05a039f76eaa2f0aa1842a3726ddc140f4dab579968a28ff5f6c284df4
SHA512

ce186036a4f3553f95f4a6aeb9fc16e748db07bf0de123e2e2bd9f49bf738ff49cae688764df4baaca56e30f7682cbd9e872d25d38b5a598da85b9e44d052440
SSDEEP

12288:a7xE2BV5fHgcg5kvmRshmzmQ48rEmGcwAPCZqqiziQCt0c:UDH1gCmshy4euCCZ1ixU0

Score

10^/10

gh0strat discovery persistence rat upx

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

50a7ce05a039f76eaa2f0aa1842a3726ddc140f4dab579968a28ff5f6c284df4.exe

Resource

win7-20241010-en

gh0strat discovery persistence rat upx

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

50a7ce05a039f76eaa2f0aa1842a3726ddc140f4dab579968a28ff5f6c284df4.exe

Resource

win10v2004-20250217-en

gh0strat discovery persistence rat upx

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  50a7ce05a039f76eaa2f0aa1842a3726ddc140f4dab579968a28ff5f6c284df4
- Size
  
  501KB
- MD5
  
  56386a779a5b1ebdd6c296d30f7165ff
- SHA1
  
  10388a3d6f12fe22f97ac541a45c6e20381ecd57
- SHA256
  
  50a7ce05a039f76eaa2f0aa1842a3726ddc140f4dab579968a28ff5f6c284df4
- SHA512
  
  ce186036a4f3553f95f4a6aeb9fc16e748db07bf0de123e2e2bd9f49bf738ff49cae688764df4baaca56e30f7682cbd9e872d25d38b5a598da85b9e44d052440
- SSDEEP
  
  12288:a7xE2BV5fHgcg5kvmRshmzmQ48rEmGcwAPCZqqiziQCt0c:UDH1gCmshy4euCCZ1ixU0
Score

10^/10

gh0strat discovery persistence rat upx
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoverypersistenceratupx

behavioral2

gh0stratdiscoverypersistenceratupx

© 2018-2025

Terms | Privacy