Overview

overview

10

Static

static

7

f8d7d9a72b...7f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f8d7d9a72bcab06b302f38c33a563988452dde8c8bfa4d67bbaffc32dd983c7f

  • Size

    157KB

  • Sample

    250405-qycy3sxxfz

  • MD5

    ff9409140eade15c0688e4e3c9979491

  • SHA1

    92d7b0d4f4dd327b5b09f3acde222788c97aabcf

  • SHA256

    f8d7d9a72bcab06b302f38c33a563988452dde8c8bfa4d67bbaffc32dd983c7f

  • SHA512

    506f975e44912a764f218feb4ffc0ab8b3c3ff71dca386b58308851130399779e5bc3548404df77fe264952b582f3cfb11c075ace40c66d6c40622dd028571d6

  • SSDEEP

    3072:LMx5+9Tj144UtgIY/IGFmVt4+eGpIeFOOtPbnKh0iJhakVZkS8q4MFJD703q:A8J144K96Ih4+ppIetPbKNhakVZWMFNn

Score
10/10
gh0stratdiscoverypersistenceratvmprotect

Malware Config

Targets

    • Target

      f8d7d9a72bcab06b302f38c33a563988452dde8c8bfa4d67bbaffc32dd983c7f

    • Size

      157KB

    • MD5

      ff9409140eade15c0688e4e3c9979491

    • SHA1

      92d7b0d4f4dd327b5b09f3acde222788c97aabcf

    • SHA256

      f8d7d9a72bcab06b302f38c33a563988452dde8c8bfa4d67bbaffc32dd983c7f

    • SHA512

      506f975e44912a764f218feb4ffc0ab8b3c3ff71dca386b58308851130399779e5bc3548404df77fe264952b582f3cfb11c075ace40c66d6c40622dd028571d6

    • SSDEEP

      3072:LMx5+9Tj144UtgIY/IGFmVt4+eGpIeFOOtPbnKh0iJhakVZkS8q4MFJD703q:A8J144K96Ih4+ppIetPbKNhakVZWMFNn

    Score
    10/10
    gh0stratdiscoverypersistenceratvmprotect

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks