Extracted

• • Target

    1b767d6b6c083960b4b3a91dddcc26ffec1337482ca645db358d4216d34c68f2

  • Size

    188KB

  • MD5

    ca28b1d6bd13f875666b6d17954501ac

  • SHA1

    0453070d9edbac07b8bde3709d668e4eda8f3d33

  • SHA256

    1b767d6b6c083960b4b3a91dddcc26ffec1337482ca645db358d4216d34c68f2

  • SHA512

    b3b78549b0fa7379176c44f09a0580a4cb43dc5d19a358888e068b8065d3db38eea3530b56317b09f50e49b6b3b32e77c97f58f3023417600530d2ff6d31550c

  • SSDEEP

    3072:HP5vwsQ9qKMJn3W2c3/bFqssLfRIG2MK+39RKPQVyFXu:vNKMJnGFYss9q23S+G

  Score

  10^/10

  gh0stratbootkitdiscoverypersistenceratspywarestealer

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2