gh0strat | 4032b49bad9750473d21f8e3907ceecb79f76a207ccc7162f173f865ec71b4d8

Analysis

max time kernel
0s
max time network
2s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4032b49bad9750473d21f8e3907ceecb79f76a207ccc7162f173f865ec71b4d8.exe
Size

1.2MB
MD5

95954589050da740de2fd99b9974a19b
SHA1

722d00e1aa257729d9ec280e9e30b78acac64742
SHA256

4032b49bad9750473d21f8e3907ceecb79f76a207ccc7162f173f865ec71b4d8
SHA512

bcf5b46adef98b716766043b01febde3876906bee2dc2a44ef514abe5a466c4f57e1d1c992bcc594193b8d972142872e1e2b9c5d0b539fb4a2fee27ae592f670
SSDEEP

24576:HovxCwgMBqHO5ZdYXOp0nQrXctTfK+d+MrTXowFlw57XYBwJti1:WIwgMEuy+inDfp3/XoCw57XYBwK1

Score

10^/10

gh0strat discovery rat upx vmprotect

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral1/memory/1628-24-0x0000000010000000-0x00000000101BA000-memory.dmp	family_gh0strat
behavioral1/files/0x00080000000160ae-31.dat	family_gh0strat
behavioral1/memory/2796-47-0x0000000010000000-0x00000000101BA000-memory.dmp	family_gh0strat
behavioral1/memory/2796-53-0x0000000010000000-0x00000000101BA000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1972-0-0x0000000000400000-0x0000000000760000-memory.dmp	vmprotect
behavioral1/memory/1972-1-0x0000000000400000-0x0000000000760000-memory.dmp	vmprotect

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1628-24-0x0000000010000000-0x00000000101BA000-memory.dmp	upx
behavioral1/memory/2796-47-0x0000000010000000-0x00000000101BA000-memory.dmp	upx
behavioral1/memory/2796-53-0x0000000010000000-0x00000000101BA000-memory.dmp	upx

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2604	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2604	PING.EXE

C:\Users\Admin\AppData\Local\Temp\4032b49bad9750473d21f8e3907ceecb79f76a207ccc7162f173f865ec71b4d8.exe
"C:\Users\Admin\AppData\Local\Temp\4032b49bad9750473d21f8e3907ceecb79f76a207ccc7162f173f865ec71b4d8.exe"
1⤵
PID:1972

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AK74.exe

Filesize
132KB

MD5
f99ce576e64a54df380f144349ef7f66

SHA1
83775c9867fee5ab71fef97e7196bd3cae50c39b

SHA256
18819b543ea8200fb110f2e4884d24497207f051707142e3edc3ec3558a9a7be

SHA512
2566efb3a801714374e7e81c1260baa9c9dd9246784772cca1159475b37828e8f7f25dcd59512bc2797314ad44ab4a324b64d926750783dd54ac362033479015

Download Submit
C:\Windows\SysWOW64\Ghiya.exe

Filesize
320KB

MD5
751a81a5794a4cd309d19a93ce5d5c66

SHA1
e44763d10e87cc98e633bf729146ccf02e8fd812

SHA256
7ab01f3e20a91f59a4d29266fa48b5e57a66354c110f554b566e78fc410f6357

SHA512
975a989cc1297a81f616b4a89250a25f938d31f12cc870f99ba957f917500bca87aa0888338580d201312bc0eb817c7b04ea45e41d8878dd9c807f3105f164fd

Download Submit
\Users\Admin\AppData\Local\Temp\AK47.exe

Filesize
91KB

MD5
423eb994ed553294f8a6813619b8da87

SHA1
eca6a16ccd13adcfc27bc1041ddef97ec8081255

SHA256
050b4f2d5ae8eaecd414318dc8e222a56f169626da6ca8feb7edd78e8b1f0218

SHA512
fab0a9af8031c242c486de373df7277c8b0e39f7a0c9c2ac2e385dbd3ea67be16e91b128287634f76131e5264149ab1b452cd21df4c4895e8c4efc8d8cf99095

Download Submit
\Windows\SysWOW64\259434093.txt

Filesize
49KB

MD5
1883a41328509b0ac1d976bd3227062f

SHA1
f29eb9d6fe33b64dce5ff53b8ad967b2aa25df9f

SHA256
6f0158c1bf08af048a0c7af9cf0b7182ba42fe81a2ebdc2a33f7a065c60a5b71

SHA512
4ddcd99a8651f05316dfee452b1c3425a04e13ba37ad5b4ec596d76c6f0d1c199a0239b5b3895d1f7c44779bd57cee019da5a92c5806aed5055428714a931f03

Download Submit
memory/1628-24-0x0000000010000000-0x00000000101BA000-memory.dmp

Filesize
1.7MB

Download
memory/1972-0-0x0000000000400000-0x0000000000760000-memory.dmp

Filesize
3.4MB

Download
memory/1972-1-0x0000000000400000-0x0000000000760000-memory.dmp

Filesize
3.4MB

Download
memory/2796-47-0x0000000010000000-0x00000000101BA000-memory.dmp

Filesize
1.7MB

Download
memory/2796-53-0x0000000010000000-0x00000000101BA000-memory.dmp

Filesize
1.7MB

Download