Extracted

• • Target

    6a592a5cd8feb57c7d8f958fc22cf871bd1a0009fad3838284bcd486ccda05ef

  • Size

    384KB

  • MD5

    46abb4873ae0a1901a909e108b4f2236

  • SHA1

    ba9e72fb87c6b77a78b673859b5376988342ae99

  • SHA256

    6a592a5cd8feb57c7d8f958fc22cf871bd1a0009fad3838284bcd486ccda05ef

  • SHA512

    0dbec57c64bbc340dc19d2c15bb7be28e4b700c4ba0f837d8942ff84704b4c23973cdb01aec7137002c7720be7ee0ff963bf5f05079b1a363632779fbeab0ee9

  • SSDEEP

    3072:tnK/yLrQbWaR5Qax8c/YtP665iNkk5gguvVNJKY4h5kIZXwlWg1tPd7ANyU:tGyLEbWaR5CcWiC5HbA5kIZg0IVjU

  Score

  10^/10

  gh0stratdiscoveryratpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2