Extracted

Extracted

• • Target
    2026-03-13_16ec005d1ec69476b53b45427a2de383_coinminer_elex_runningrat_wannacry_zxshell
  • Size 196KB
  • SHA256 d785d599b4c918c3e644138e4a8a58db8e18e4cba1263f525cf46a00b88a5d25
  • MD5 16ec005d1ec69476b53b45427a2de383
  • SHA1 8734719c16e88e55d5c4ee1d5f6f7b1d412cdb15
  • SHA512 0a522cb40b97e2f96fcc28b3483d7fb596f9cfc44d7c69d2b4d21ce05a4667ac6cb25bea62692fbec98f91ae30664986ffa9e4d9700816e620f483af59ee51db
  • SSDEEP 1536:gFhqEA70HzLJksPEOajozLElnqiO2cb+g4h7DsSp9:gjXTLJkQ7zAV3DT7
  • TLSH
    T156140582A3D02512F1AF3B706975133A4A793CB51F2582EFF2D6C54E18799E1AE7070B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverygh0stratrunningratpersistenceratupx

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • RunningRat

    RunningRat is a remote access trojan first seen in 2018.

    ratrunningrat

  • RunningRat payload

  • Runningrat family

    runningrat

  • UPX dump on OEP (original entry point)

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2