Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 03:26
General
-
Target
f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe
-
Size
139KB
-
MD5
871b39db6a5a750aaaf6482fec0f1a0a
-
SHA1
6caf213743fb8b852a193b17da442dd28c3d1377
-
SHA256
f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a
-
SHA512
11cf2644a17cc8c8f61d8e578ab500b7df63447f28b2246eb2fddeaa7ce961b9099e44932d50c360c91059b45f48e530042153e9f52c6cb7cb092f2c42773830
-
SSDEEP
3072:8yIpG2/iDbYZlT9VjTaeKAYbypHJHhlNTsME55m:hIpos/3jTXK1ypba
Malware Config
Extracted
gh0strat
192.168.4.9
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe"C:\Users\Admin\AppData\Local\Temp\f6ca654e7e1eeb23c06abe0da608a1239c35981bac1a4c32dfb5e3465f67074a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
452KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
452KB