Extracted

• • Target

    cfed7abc2cdce41348af42dd516e8731d4de0ceaa14c6c3a0e48ebd539e22559

  • Size

    83KB

  • MD5

    4e969a3e3014194ed6e33f384fe3394c

  • SHA1

    3209f7973906286f182dc1574c571356834c2b1c

  • SHA256

    cfed7abc2cdce41348af42dd516e8731d4de0ceaa14c6c3a0e48ebd539e22559

  • SHA512

    ca88c9a6b493b658498de783d1b95cabbf8d7fd49c06636adb33c66a7bd861ea310c5484d92c293a75025b21e528b3581f170691c070161e40a0e51a48339501

  • SSDEEP

    1536:nQgUoFley2HuI4eB7qsd1yre4zm4miCRv4KCrVFxOJ4rw4XKpf:mElKxd8rhzqiAw4Jzpf

  Score

  10^/10

  gh0stratbootkitdiscoverypersistenceratspywarestealerupx

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Blocklisted process makes network request

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2