Overview

overview

10

Static

static

10

bb7f474008...09.dll

windows7-x64

10

bb7f474008...09.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e557c646ae2e0fbd7aa05b4d4004670.bin

  • Size

    79KB

  • Sample

    250307-bqfyfa1wbv

  • MD5

    233eac477db1c155df0f490a0e6deba7

  • SHA1

    c73a52a540f575b278ab110cfc74d2b19f4ad2ba

  • SHA256

    87a696a93a56d9f61066baaba9160eb05fa373d08d08f2acc72b316253a4d581

  • SHA512

    ae4d7f3da15660a479854e56017ddfee6b2c14a345d3305c27d51d5fdef484fa1e960f7ddbc57ea277b1f42f5ba5f88f95d098bff188b4124c20e7960099bc57

  • SSDEEP

    1536:kDGwhWDCfeyYti83gymLWITPPfE1hGVIVKgT8K3ZV1NFPTlozPfI+ZjBra:FoWGfeyYtj3dmLWoXfCTZNFrlMBjBu

Score
10/10
gh0stratdiscoveryrat

Malware Config

Targets

    • Target

      bb7f474008142e7f8a81dfd3bb121b99e23bc262c2ef34c83cd33cc3db5f5509.dll

    • Size

      172KB

    • MD5

      5e557c646ae2e0fbd7aa05b4d4004670

    • SHA1

      8e2e03baad6a099ee044a78cf0ee0cbe644581ad

    • SHA256

      bb7f474008142e7f8a81dfd3bb121b99e23bc262c2ef34c83cd33cc3db5f5509

    • SHA512

      90d5df37856cc948684fb82947391f9fb6b26cba1ece6ab620e264324debf20923e24a909ef46bec2a4923546721ce3a0c0d335d8172235242d5de7c9d6437ff

    • SSDEEP

      3072:+/gWEkncfFsQTvrhPkC7xZkuXaJhNeETNsAq6nUlk6/MPNm:+LPnc2qrJ51ZkMaJhQCNBU8

    Score
    10/10
    gh0stratdiscoveryrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Blocklisted process makes network request

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks