Overview

overview

10

Static

static

3

2025-04-05...ys.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-05_3fd07e72668e397cc0f9525db7269359_black-basta_coinminer_hijackloader_icedid_luca-stealer_remcos_rhadamanthys

  • Size

    4.7MB

  • Sample

    250405-azh9gsw1gt

  • MD5

    3fd07e72668e397cc0f9525db7269359

  • SHA1

    8dcb773e08410b6ef948c0cfc97742db94e1c8f1

  • SHA256

    13d75bd14c09f2a251f70897eb09d1201610e431fd6f5f41e8206c13c2ed32ab

  • SHA512

    17cb2fd597568dd243a5e45b91ac0ba593e3104675c15b8d714ba9669fa5b7f9e7664d5847f7d7dfe1c550da196133fe421978d2e01a5821a848ffe5fcc95d64

  • SSDEEP

    49152:jYREXSVMDi3pPCebXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl2X:s2SVMD8nbXsPN5kiQaZ56

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      2025-04-05_3fd07e72668e397cc0f9525db7269359_black-basta_coinminer_hijackloader_icedid_luca-stealer_remcos_rhadamanthys

    • Size

      4.7MB

    • MD5

      3fd07e72668e397cc0f9525db7269359

    • SHA1

      8dcb773e08410b6ef948c0cfc97742db94e1c8f1

    • SHA256

      13d75bd14c09f2a251f70897eb09d1201610e431fd6f5f41e8206c13c2ed32ab

    • SHA512

      17cb2fd597568dd243a5e45b91ac0ba593e3104675c15b8d714ba9669fa5b7f9e7664d5847f7d7dfe1c550da196133fe421978d2e01a5821a848ffe5fcc95d64

    • SSDEEP

      49152:jYREXSVMDi3pPCebXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl2X:s2SVMD8nbXsPN5kiQaZ56

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks