Extracted

• • Target

    f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a

  • Size

    139KB

  • MD5

    871b39db6a5a750aaaf6482fec0f1a0a

  • SHA1

    6caf213743fb8b852a193b17da442dd28c3d1377

  • SHA256

    f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a

  • SHA512

    11cf2644a17cc8c8f61d8e578ab500b7df63447f28b2246eb2fddeaa7ce961b9099e44932d50c360c91059b45f48e530042153e9f52c6cb7cb092f2c42773830

  • SSDEEP

    3072:8yIpG2/iDbYZlT9VjTaeKAYbypHJHhlNTsME55m:hIpos/3jTXK1ypba

  Score

  10^/10

  gh0stratdiscoveryratupxpersistence

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2