gh0strat | 3f1ad0b1cd5a17de09dc0fae2df9928a8e70e0e4a4ec52f78cbd5585dc58250c

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 11:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_3f1ad0b1cd5a17de09dc0fae2df9928a8e70e0e4a4ec52f78cbd5585dc58250c.exe
Size 125KB
Sample260930-nrdkxsthja
SHA256 3f1ad0b1cd5a17de09dc0fae2df9928a8e70e0e4a4ec52f78cbd5585dc58250c
MD5 d9926d95e5a3694abca4c04b105ccb97
SHA1 af7e18253d22b245560c7f73fcc608faa3a4fbe3
SHA512 08c7d9a89217f6d15530c93f51bfa0eab9a8a5a188e726889e18f21748e7e9a766ca7b5c004ae15eda131633390d7076172d306c132945162f1ce49360253d9b
SSDEEP 3072:va7C7/BhWsH82Slcf7YdqsyPUJxGkbRzv1:va7O/HHimYQdcJx1bRz
TLSH
T1A5C36E02F18541FAF6A9117C14AF7776A63BA9D48B086FC37B24DE641C63161E73238B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery gh0strat persistence rat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 3 IoCs

resource	yara_rule
behavioral2/memory/2976-0-0x0000000000400000-0x0000000000421000-memory.dmp	family_gh0strat
behavioral2/memory/2976-3-0x0000000000400000-0x0000000000421000-memory.dmp	family_gh0strat
behavioral2/files/0x000d00000001c5a1-2.dat	family_gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Microsoft MSP2\Parameters\ServiceDll = "C:\\Windows\\system32\\360SP2.dll"	jaffacakes118_3f1ad0b1cd5a17de09dc0fae2df9928a8e70e0e4a4ec52f78cbd5585dc58250c.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1324	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1324	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\360SP2.dll	jaffacakes118_3f1ad0b1cd5a17de09dc0fae2df9928a8e70e0e4a4ec52f78cbd5585dc58250c.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3f1ad0b1cd5a17de09dc0fae2df9928a8e70e0e4a4ec52f78cbd5585dc58250c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3f1ad0b1cd5a17de09dc0fae2df9928a8e70e0e4a4ec52f78cbd5585dc58250c.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3f1ad0b1cd5a17de09dc0fae2df9928a8e70e0e4a4ec52f78cbd5585dc58250c.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2976

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

360sp2.dll

Path \??\c:\windows\SysWOW64\360sp2.dll
Size 117KB
SHA256 4f291185774d1ee5ba73f04232acabd1615ae34a3b3e1cbac4b3b372e0c884a1
MD5 d457bdbb1b20ec8fcfee391bdde411f1
SHA1 8c9e7274bca15c99fc629d6bf2054425f638f311
SHA512 c323b55ee6eb7217356c6fec80d6904fd0f55e317348f1b72e4b51d30f8369fb18541a78907cb9b29d361f6136d3243db449813552fc0f5800ea86d3cc1b35cf
SSDEEP 1536:Oz7N/gGBBw4Wse48tcxjMlccs7efdqsR+Y4PUJxGkbEYzv1L:07/BhWsH82Slcf7YdqsyPUJxGkbRzv1L
TLSH
T102C37E02F1C541FAF6A9117C14AF7776A63BA9D48B185FC37B24DE641C23161EB2238B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2976-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2976-3-0x0000000000400000-0x0000000000421000-memory.dmp