Extracted

• • Target
    2026-08-15_db1ad793e4984004d48496a4f5555694_chinachopper_elex_runningrat_wannacry_zxshell
  • Size 108KB
  • SHA256 c46ac4e5625910831e6c00759ecc2a0c631d3f366e1e3c94f7b5675cd34407a1
  • MD5 db1ad793e4984004d48496a4f5555694
  • SHA1 f820a318d59682e268c0947c1df9bcdb21330a58
  • SHA512 d0e14c078e81ef7fd3c1790c9db78c5b767d7c4454038565faa82ddad605e98f1579d9106d1e1b7acd6fa17251728c5275087196a16c630debe8c3c6d0e2f680
  • SSDEEP 1536:lqEA70HzLJksPEOajozLElnqiO2jdgPb:lXTLJkQ7zAV3KPb
  • TLSH
    T1CAB3E442A3E02512E1AF3B74697502364A7A3C7A5F2182EFF2D5C54E18799E1EE7070B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiongh0stratrunningratpersistencerat

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: RunningRat

    RunningRat is a remote access trojan first seen in 2018.

    ratrunningrat

  • Gh0st RAT payload

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2