Overview

overview

10

Static

static

10

bb7f474008...09.dll

windows7-x64

10

bb7f474008...09.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb7f474008142e7f8a81dfd3bb121b99e23bc262c2ef34c83cd33cc3db5f5509.dll

  • Size

    172KB

  • Sample

    250306-fpaggsyycv

  • MD5

    5e557c646ae2e0fbd7aa05b4d4004670

  • SHA1

    8e2e03baad6a099ee044a78cf0ee0cbe644581ad

  • SHA256

    bb7f474008142e7f8a81dfd3bb121b99e23bc262c2ef34c83cd33cc3db5f5509

  • SHA512

    90d5df37856cc948684fb82947391f9fb6b26cba1ece6ab620e264324debf20923e24a909ef46bec2a4923546721ce3a0c0d335d8172235242d5de7c9d6437ff

  • SSDEEP

    3072:+/gWEkncfFsQTvrhPkC7xZkuXaJhNeETNsAq6nUlk6/MPNm:+LPnc2qrJ51ZkMaJhQCNBU8

Score
10/10
gh0stratdiscoveryrat

Malware Config

Targets

    • Target

      bb7f474008142e7f8a81dfd3bb121b99e23bc262c2ef34c83cd33cc3db5f5509.dll

    • Size

      172KB

    • MD5

      5e557c646ae2e0fbd7aa05b4d4004670

    • SHA1

      8e2e03baad6a099ee044a78cf0ee0cbe644581ad

    • SHA256

      bb7f474008142e7f8a81dfd3bb121b99e23bc262c2ef34c83cd33cc3db5f5509

    • SHA512

      90d5df37856cc948684fb82947391f9fb6b26cba1ece6ab620e264324debf20923e24a909ef46bec2a4923546721ce3a0c0d335d8172235242d5de7c9d6437ff

    • SSDEEP

      3072:+/gWEkncfFsQTvrhPkC7xZkuXaJhNeETNsAq6nUlk6/MPNm:+LPnc2qrJ51ZkMaJhQCNBU8

    Score
    10/10
    gh0stratdiscoveryrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks