General
-
Target
69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661
-
Size
1.2MB
-
Sample
250329-cn6lrawva1
-
MD5
c1599d973af9fcdeb40aa72ffeaaaa72
-
SHA1
28cee9027afc64ba28c6ad90583bcafd5f2127d1
-
SHA256
69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661
-
SHA512
ce2178c9dcc14561259531fd9f5e265ccf9afa306c2c1779de0a2ad04116dc8f8bca37981fdf1f32590473fd86c87c422dd37c229fbbea9f0372cb7da638bdc3
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtii:WIwgMEuy+inDfp3/XoCw57XYBwKi
Behavioral task
behavioral1
Sample
69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661.exe
Resource
win7-20240903-en
Malware Config
Targets
-
-
Target
69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661
-
Size
1.2MB
-
MD5
c1599d973af9fcdeb40aa72ffeaaaa72
-
SHA1
28cee9027afc64ba28c6ad90583bcafd5f2127d1
-
SHA256
69c35d7e9263cbd972093db901f3fc8460cbc81749564e40262f7ca5945bf661
-
SHA512
ce2178c9dcc14561259531fd9f5e265ccf9afa306c2c1779de0a2ad04116dc8f8bca37981fdf1f32590473fd86c87c422dd37c229fbbea9f0372cb7da638bdc3
-
SSDEEP
24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJtii:WIwgMEuy+inDfp3/XoCw57XYBwKi
-
Gh0st RAT payload
-
Gh0strat family
-
Purplefox family
-
Drops file in Drivers directory
-
Server Software Component: Terminal Services DLL
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2