gh0strat | 4be7ecf5048eb2816c172ea68864144b63d8fb4b425bd8f75feeec0eb7a65851

General

Target
4be7ecf5048eb2816c172ea68864144b63d8fb4b425bd8f75feeec0eb7a65851
Size 197KB
Sample260808-p31p9sxcnb
SHA256 4be7ecf5048eb2816c172ea68864144b63d8fb4b425bd8f75feeec0eb7a65851
MD5 69c70b8076247b3957b17c879db43af5
SHA1 ce372802d4e29feb46caf3010f7da97916658a61
SHA512 9d5b989bbf2488214e327b27e29a3ed5d93a9edd4c80f2f8a2199a12603e33c48f6963ab8baab3372f04f9b63f353f5c8c1cb1d9027f41c76adbfe91b99cdd95
SSDEEP 3072:XNsKL3edxM7J2SSSUbFle+7aMn5y6oAP7/6r5lg5Al4AxJ25M/gmEPR4sqL:dsKzevM7Fu54+xy6FwC5I4yhKNqL
TLSH
T136141283911D7862EE131E307DF4E436603A7FB005A267C7F11A97627E92B44CEDA272
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  4be7ecf5048eb2816c172ea68864144b63d8fb4b425bd8f75feeec0eb7a65851
- Size 197KB
- SHA256 4be7ecf5048eb2816c172ea68864144b63d8fb4b425bd8f75feeec0eb7a65851
- MD5 69c70b8076247b3957b17c879db43af5
- SHA1 ce372802d4e29feb46caf3010f7da97916658a61
- SHA512 9d5b989bbf2488214e327b27e29a3ed5d93a9edd4c80f2f8a2199a12603e33c48f6963ab8baab3372f04f9b63f353f5c8c1cb1d9027f41c76adbfe91b99cdd95
- SSDEEP 3072:XNsKL3edxM7J2SSSUbFle+7aMn5y6oAP7/6r5lg5Al4AxJ25M/gmEPR4sqL:dsKzevM7Fu54+xy6FwC5I4yhKNqL
- TLSH
  T136141283911D7862EE131E307DF4E436603A7FB005A267C7F11A97627E92B44CEDA272
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat upx
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Gh0strat

Gh0st RAT payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2