Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04/03/2025, 11:25
General
-
Target
941破解58G宇宙加速器/941破解58G宇宙加速器.exe
-
Size
1.5MB
-
MD5
d5016ca94c3e3beac7631c6fa23c5b6e
-
SHA1
3b74eaf4d380723accd848072ccbde71dcf58e93
-
SHA256
2aef16116d3b4b82dcbc7a7b57a7ee06521656d36d396e0d865b5deb70a103aa
-
SHA512
794aef7305195d8cc44e1c39978014673bcf21a22c2c435b4eff8a9cbc5d2a8db944ddd396cf5ba860b261fef6062b37be18c05b38be7931c9d50c59a35936ad
-
SSDEEP
24576:2l3rNrwWD2ZmXJAcDEjrbnhlbh+GPdW5hvZdM/N5Xp:2l3prC05IfnhJhFeRap
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 23 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\941破解58G宇宙加速器\941破解58G宇宙加速器.exe"C:\Users\Admin\AppData\Local\Temp\941破解58G宇宙加速器\941破解58G宇宙加速器.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\shurufa.imeC:\shurufa.ime2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD57a042c27a00168bdc1f6df253b0d3ce2
SHA102c05a9b57b6c1a818b6293ed359cc692b6d80e0
SHA256249a3c708069773bc120fa63ca9a68c510e773c7fcdfc7936cc464272b73cfdb
SHA5124bdfc5a595d046af5564e619adfce34f7e9ca34d8fecab57c5ff39dd20f8fb8ee1463753c47e29203953c6fc21a7f192ac66129aefa05b7ed0736968c76b8983
-
Filesize
5.3MB
MD5c392dc7a0178724f95abaee917968550
SHA1ef7494835d73abcf74510688ca893a5e0cc70a7f
SHA25669d58846e776957daab54502e98e18c2349d672ca79fa6c9e39ea59c269db4f8
SHA5127e3fd6aece6eae8630e510ada68870f01ce6b5c1a8938e87dea01406097cf8831a39d232f013f337e8f0a5c32e4780c0e23e1cb723e8f0275611df3a05a46fe4
-
Filesize
13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
Filesize
168B
MD590d2d3912d6532f9a84d848d3c46be80
SHA164bb94a94557f392cda7ccd72cb25bf1a4c90f9d
SHA256f2b8cbc17720566242d257adbca835cd6d7dc16eb99ddfe2c1639d7405d175b2
SHA512b25668e667c53f4d3d0417014439d309261a207f0b050aeeb598e383b0905c76eee03719b6e3d14e72ff5a7ebcc936d21d1e0af66284c7c0852f4279c1125277
-
Filesize
210KB
MD57dfe7ce5e70121590352fb96cf1e61b1
SHA13ae79222d4124e468b7addf4119a98dc5b45d995
SHA2566533fa9a4b8ce9d90b56f5868f8e552616e5977b1cb02add30601faec5cfc62f
SHA512dd735e510de16acdad734be1a7a27006b73603a9d66afd12a46ad8a5d96c00bd5068c5fa2ad36864c618b9eafdf0546d10aea2c6a800b4c3a16b7ee99c9d490e
-
Filesize
28B
MD5ec8c1588a3c07773d4a1846cdd7276b5
SHA1280ede1e2fad653f0d8c0639d22267f7f14babc6
SHA2564c8a767bc24e72b987e90b2bb988c9ad966c7db52831c34f2a129c791d26524d
SHA512a6d80c79cf2769aa5a848abdbe8a8ae19bb6e697adc718a604728e05ba30c9dc9462e917fd7b4346a5fc65ea869a4331baac7eed88db60966d70cc774ae38064
-
Filesize
120KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
1024KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
1024KB
