gh0strat | 3883b8f5211b38976033ac78c418828561542d5c836a91d2278a3c3599555997

General

Target
2026-10-07_4c31ab5fc99edd313d4b1d99ea30f4f4_elex_gh0st-rat_wannacry
Size 19.6MB
Sample261007-q5zfnabb22
SHA256 3883b8f5211b38976033ac78c418828561542d5c836a91d2278a3c3599555997
MD5 4c31ab5fc99edd313d4b1d99ea30f4f4
SHA1 54085d4dc7440196309b1f79fd1b900867310af9
SHA512 3e5eb7d1ce7c993e6691285244e82583264f6e45d8b9455505de77a2b689a499bc264bfbda6c2d37a1c829b60bd6c1ae7244e297fc524628dd954a8f4ae89eaa
SSDEEP 6144:jsIt6nW8QXBTyPRqyhYPbHcTBlhHryndnkv0e:Q9W8BJq8YPbHcT3JP
TLSH
T1AD278E43EB8148FAC8DD167850BAA77A363B9A504B181FC7BB54EFF014E30415A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-07_4c31ab5fc99edd313d4b1d99ea30f4f4_elex_gh0st-rat_wannacry
- Size 19.6MB
- SHA256 3883b8f5211b38976033ac78c418828561542d5c836a91d2278a3c3599555997
- MD5 4c31ab5fc99edd313d4b1d99ea30f4f4
- SHA1 54085d4dc7440196309b1f79fd1b900867310af9
- SHA512 3e5eb7d1ce7c993e6691285244e82583264f6e45d8b9455505de77a2b689a499bc264bfbda6c2d37a1c829b60bd6c1ae7244e297fc524628dd954a8f4ae89eaa
- SSDEEP 6144:jsIt6nW8QXBTyPRqyhYPbHcTBlhHryndnkv0e:Q9W8BJq8YPbHcT3JP
- TLSH
  T1AD278E43EB8148FAC8DD167850BAA77A363B9A504B181FC7BB54EFF014E30415A3BD96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Family: Gh0strat

Gh0st RAT payload

Deletes itself

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2