Overview

overview

10

Static

static

3

d2a1eaedba...2b.exe

windows7-x64

10

d2a1eaedba...2b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d2a1eaedbaaa1d37a0cf6275ed1ba241437047ea206bf9f92043b31a9082972b

  • Size

    2.2MB

  • Sample

    250306-pj1wxsyn13

  • MD5

    4b516af36eb352798108ae0318dc913a

  • SHA1

    9eb738904e80784b59b0d12743348e45079853dd

  • SHA256

    d2a1eaedbaaa1d37a0cf6275ed1ba241437047ea206bf9f92043b31a9082972b

  • SHA512

    dfd0b23d26398d51af34da23be6bcf77013491a31876ca1bc0216510dd717b8bcaa7ed687aebb87fff04400265555adb3bad7a39f73d052007df14e37ed971b7

  • SSDEEP

    24576:QOvfKVPgFtTRfUxgul41mMa3+O6D6z87l/G+:P3K2fRWOmMa3+O6D6o7l/G+

Score
10/10
gh0stratdiscoveryexecutionrat

Malware Config

Targets

    • Target

      d2a1eaedbaaa1d37a0cf6275ed1ba241437047ea206bf9f92043b31a9082972b

    • Size

      2.2MB

    • MD5

      4b516af36eb352798108ae0318dc913a

    • SHA1

      9eb738904e80784b59b0d12743348e45079853dd

    • SHA256

      d2a1eaedbaaa1d37a0cf6275ed1ba241437047ea206bf9f92043b31a9082972b

    • SHA512

      dfd0b23d26398d51af34da23be6bcf77013491a31876ca1bc0216510dd717b8bcaa7ed687aebb87fff04400265555adb3bad7a39f73d052007df14e37ed971b7

    • SSDEEP

      24576:QOvfKVPgFtTRfUxgul41mMa3+O6D6z87l/G+:P3K2fRWOmMa3+O6D6o7l/G+

    Score
    10/10
    gh0stratdiscoveryexecutionrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks