Overview

overview

10

Static

static

3

4fe9e6e0d3...b6.exe

windows7-x64

10

4fe9e6e0d3...b6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4fe9e6e0d3bbaf80f806ea9ae571df788d41abdd8246ce2a493aef169f4814b6

  • Size

    440KB

  • Sample

    250306-qq3jrsyzh1

  • MD5

    12d2e7820737ca9da0076c401371bbec

  • SHA1

    bff20c99ca7381332c93dd2fa2fa14e5818d7f58

  • SHA256

    4fe9e6e0d3bbaf80f806ea9ae571df788d41abdd8246ce2a493aef169f4814b6

  • SHA512

    9a81b66414b0556020d7d26aae76496fc4506a8f8cdc42028f7b562c0948083c175225f6c6443df2602c2081fda18c38034e93839cd92c3f58df181ca215f1e6

  • SSDEEP

    6144:Xbwen1gUU1lzgAyWMZ7qxHDP7DBFi6PWgIlDP6FPm/h4VSdEn+3Y1tMmbWs:XbweCa1qpT2FGm/hsr+3Y12wW

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      4fe9e6e0d3bbaf80f806ea9ae571df788d41abdd8246ce2a493aef169f4814b6

    • Size

      440KB

    • MD5

      12d2e7820737ca9da0076c401371bbec

    • SHA1

      bff20c99ca7381332c93dd2fa2fa14e5818d7f58

    • SHA256

      4fe9e6e0d3bbaf80f806ea9ae571df788d41abdd8246ce2a493aef169f4814b6

    • SHA512

      9a81b66414b0556020d7d26aae76496fc4506a8f8cdc42028f7b562c0948083c175225f6c6443df2602c2081fda18c38034e93839cd92c3f58df181ca215f1e6

    • SSDEEP

      6144:Xbwen1gUU1lzgAyWMZ7qxHDP7DBFi6PWgIlDP6FPm/h4VSdEn+3Y1tMmbWs:XbweCa1qpT2FGm/hsr+3Y12wW

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks