Overview

overview

10

Static

static

3

2025-04-05...ys.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-04-05_c24b7a18cc85aac46b6514ae60ab11fa_black-basta_coinminer_hijackloader_icedid_luca-stealer_remcos_rhadamanthys

  • Size

    4.5MB

  • Sample

    250405-sp6wxazydt

  • MD5

    c24b7a18cc85aac46b6514ae60ab11fa

  • SHA1

    c753ac17bc04eff8cf0013afc53f1b4f939df7fe

  • SHA256

    85755f1c634b73f672c066b8de6d7e34a99a7877f6bca683815e82a825754844

  • SHA512

    ff1144e76b96522607f5bc5971bf5dd2e08e692207cd48ef5d1250ffbe25a41ffdc7d02e3bf69eed5cb1afd39972f21a2d7444084e604abf01946af6ce318722

  • SSDEEP

    49152:EYREXSVMKi3HbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PLn:92SVMK8HbXsPN5kiQaZ56

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      2025-04-05_c24b7a18cc85aac46b6514ae60ab11fa_black-basta_coinminer_hijackloader_icedid_luca-stealer_remcos_rhadamanthys

    • Size

      4.5MB

    • MD5

      c24b7a18cc85aac46b6514ae60ab11fa

    • SHA1

      c753ac17bc04eff8cf0013afc53f1b4f939df7fe

    • SHA256

      85755f1c634b73f672c066b8de6d7e34a99a7877f6bca683815e82a825754844

    • SHA512

      ff1144e76b96522607f5bc5971bf5dd2e08e692207cd48ef5d1250ffbe25a41ffdc7d02e3bf69eed5cb1afd39972f21a2d7444084e604abf01946af6ce318722

    • SSDEEP

      49152:EYREXSVMKi3HbXsPNIULkmp1/j6AeXZG7wmpvGF1IP9z5WuHC4O8b8ITDnl27PLn:92SVMK8HbXsPN5kiQaZ56

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks