gh0strat | 4e8080d7574aa4563ccbe3d3594bfd8ae32fd9aebd3da38a17dfc5ba3d48f229

Sharing

Copy URL Twitter E-mail

General

Target
4e8080d7574aa4563ccbe3d3594bfd8ae32fd9aebd3da38a17dfc5ba3d48f229
Size 694KB
Sample261102-le61lastcx
SHA256 4e8080d7574aa4563ccbe3d3594bfd8ae32fd9aebd3da38a17dfc5ba3d48f229
MD5 076e410a4560defc8a07ff9965ba2cf4
SHA1 b1efdebf77f52f7173a64ef84bbbfa3574de48da
SHA512 e7c8d2e5e4f1e68d7c32cf28be2cfcdde97426b02c7cb2db17cef46a93232925928ec29742543e9bdf5f69dd6270972de9556921719e1d701fca697633bb3fe8
SSDEEP 12288:D4ye4yo4yA4yE4yN4y4U4yc4yZ4DF43o43k4yvWi/QHSAdOzUqghAA3YngM/1tMx:8yJy7yzyPyGF/ynyKDe373vyei/UdCUp
TLSH
T188E4022085198371C993133897BCA6B3D8ACA3451EEE3B606DB5953D1BE04B2BC5397F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

gh0strat

kinh.xmcxmr.com

Targets

- Target
  1332390.bat
- Size 51KB
- SHA256 6d5eeac3bcd1180aa057fa1b20a4c4c604a6167871c48b4b9ea2e2d57ea64bc8
- MD5 0842f7cbeb13b5e4302b4045f5e52266
- SHA1 914a6584a347001d6187cf9723cc040742610592
- SHA512 c07641486d174e971c5c373ca5b7bb169cf8225beaa9311dbe1121ffaa55970c9e75a3a5e8be9fd8b94c9f08eafdbb9e32ac1b2bb32f49175a6b20589e6f3bab
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLXJYH5:1dWubF3n9S91BF3fboTJYH5
- TLSH
  T1D1333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral1 behavioral2
- Target
  175439750.bat
- Size 51KB
- SHA256 4bc86aebc92cab26fb6b05f4647dd99098a5316dfcb6e963e4fb91a742284a81
- MD5 dca5fb2c6effbe6d6cfbdec08aa3e7eb
- SHA1 719cad7bb62a04c3090bc15141c525da597ef8cd
- SHA512 ad448b74ef476972a764cace97bbd62933a0c2472d4f5d95f91cc08a4d8cede1b23a410ed2f41aa39401805be8ff0fe59a9f969f4fb6256783de390f8dca2f57
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL/JYH5:1dWubF3n9S91BF3fborJYH5
- TLSH
  T1E1333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral3 behavioral4
- Target
  175453312.bat
- Size 51KB
- SHA256 4bc86aebc92cab26fb6b05f4647dd99098a5316dfcb6e963e4fb91a742284a81
- MD5 dca5fb2c6effbe6d6cfbdec08aa3e7eb
- SHA1 719cad7bb62a04c3090bc15141c525da597ef8cd
- SHA512 ad448b74ef476972a764cace97bbd62933a0c2472d4f5d95f91cc08a4d8cede1b23a410ed2f41aa39401805be8ff0fe59a9f969f4fb6256783de390f8dca2f57
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL/JYH5:1dWubF3n9S91BF3fborJYH5
- TLSH
  T1E1333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral5 behavioral6
- Target
  350743656.bat
- Size 51KB
- SHA256 ceb21952afa73c05349eaea6b4e2796009e2e365488cd867fcd626f942cf6862
- MD5 63e146b6a367ccd21bb98304607d3286
- SHA1 80790206cee9e5bc7349d76e43c52b807add9f7a
- SHA512 6ab6c2a5358e4660ed24f3b34b5ed895eb22283dcbc57f94509f5cd869e3050ffe1e080a58fb37fbba50bb40341c6cfae802c42aa3bf424d770481fd66170b17
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLfJYH5:1dWubF3n9S91BF3fbozJYH5
- TLSH
  T1BE333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral7 behavioral8
- Target
  397073000.bat
- Size 51KB
- SHA256 530e31c1fc8341f9fc47a8e733b80962664b017e3a800e81037b1f635033917d
- MD5 ce37f17177b8afb2c2f5bb83851a9c36
- SHA1 8dfd87eaa08e45606537dbcbfad3b9d6cb2f6223
- SHA512 e6f8e18ca4929d10aeb2e387a959f61fd03749adf0b90c0f362211bca50b970a5d6789043d9c1618088585e8aa230d5a39c38ed6b685143f7889ff2f444d4227
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLvJYH5:1dWubF3n9S91BF3fborJYH5
- TLSH
  T1E3333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral10 behavioral9
- Target
  637690500.bat
- Size 51KB
- SHA256 f8d496dec2053d66e02a6940c0c3db1727451104f41e783fe0c8d80c7a007164
- MD5 5845224f3368cc6e52bd054cf40cf127
- SHA1 a72a70f24f071dcca29f15e11c465fd03a9f64a3
- SHA512 8858057e25ce27f0a02c78e1f02e518b2228b4b0145da0f046d336c926217693e3cce373b2484b5e04069d978fad942705b97a6b439356be808d21678331bcbe
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLjJYH5:1dWubF3n9S91BF3fboHJYH5
- TLSH
  T1AD333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral11 behavioral12
- Target
  84309031.bat
- Size 51KB
- SHA256 24ce1b7dd645a2051b87335300d44c56f5884e81cb8949879995c394b0c8e836
- MD5 363bc77e76b13d5045bc223d60cc2bbf
- SHA1 0b6558e943180a730da37c238df9c103cc83f611
- SHA512 cf1630db6dce2fa85dffc3225fbd53fa2751738c5374404afcb432304cadfd367ec674d6048fa1a32f8bb9e495d68022dd8de23b3a9b6c1c9f9505ec19b41d14
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLVJYH5:1dWubF3n9S91BF3fboZJYH5
- TLSH
  T192334A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral13 behavioral14
- Target
  84463156.bat
- Size 51KB
- SHA256 ea1a2877f4b6389b127803f62f3c91c4bb617f06d8f83e9e50d28a8c76fd892c
- MD5 ab9b8ed7bd5b2e08c3e43bae60d15a9e
- SHA1 710e047e98e58dcc899d44a2cce05e1a285d124d
- SHA512 396a420a49920c9e01b56b15a0a83ee9516f8e421f18e74a777e962c1f7f912714aee860fdd1563a88da591a31d9a63042cae88e883e4a37da632da00473812d
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLtJYH5:1dWubF3n9S91BF3fboxJYH5
- TLSH
  T1C5334A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral15 behavioral16
- Target
  84518578.bat
- Size 51KB
- SHA256 3f900e52e5fc6e9411345c008455dc3438f36fe20c4de6616221e7efd7af3c20
- MD5 69379a1d0dfd8b5a9c7a0272d8e9e24c
- SHA1 935f9171d6a5920bcab14aa8a757544ff27a88e9
- SHA512 bcb167769a959f05bf0abe130f787d9ef765f27ddb7631f69b2fbc5d802a51086ea6f278368e2d42c2ff70b2226b8e8f9b6978b132acb63e4f383c4c87191873
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLsJYH5:1dWubF3n9S91BF3fboAJYH5
- TLSH
  T11A334A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral17 behavioral18
- Target
  854816890.bat
- Size 51KB
- SHA256 ef460ebad49c6ae147855b31453403de41d14927972428964a457c2ff9a6821e
- MD5 baea98a5f6ff67ac27d9327adb60bbc0
- SHA1 229dd5f69990a242225f47b8368f408fa6d066a6
- SHA512 aa1cd387ed4727e60eecd11a5a467442f44ed5aa0743990d5968867209c79b7e2c62ea039d066f89b5997422de1698ed5d256ac7de0cc20d1c0af07634c67879
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL0JYH5:1dWubF3n9S91BF3fboYJYH5
- TLSH
  T1CC334A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral19 behavioral20
- Target
  93388484.bat
- Size 51KB
- SHA256 4d413ed4dca5b41ca4935725ef10123b0f87dbb5e3eaef14d1ff5fbea42cc529
- MD5 ac2925c40cf76976d61c3eb8290efe7f
- SHA1 3e1fc4d31fcfdcdeb0b98a1b28e85a63e93300c7
- SHA512 faecbb329cb35047ad8d2c060fa2d207b01311443d8c08c56b6dd3fb4dbb8cfd565179d06a8af3eb5a4023a97fe213bda50bb3916feac44bcddae51cae3256c5
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLeJYH5:1dWubF3n9S91BF3fboKJYH5
- TLSH
  T1B4333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral21 behavioral22
- Target
  93417718.bat
- Size 51KB
- SHA256 4d413ed4dca5b41ca4935725ef10123b0f87dbb5e3eaef14d1ff5fbea42cc529
- MD5 ac2925c40cf76976d61c3eb8290efe7f
- SHA1 3e1fc4d31fcfdcdeb0b98a1b28e85a63e93300c7
- SHA512 faecbb329cb35047ad8d2c060fa2d207b01311443d8c08c56b6dd3fb4dbb8cfd565179d06a8af3eb5a4023a97fe213bda50bb3916feac44bcddae51cae3256c5
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLeJYH5:1dWubF3n9S91BF3fboKJYH5
- TLSH
  T1B4333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral23 behavioral24
- Target
  93999343.bat
- Size 51KB
- SHA256 f7ad65434397ae7e8ee10177f8e86fe4c05b560f98fa75aa62b24785cdc0880e
- MD5 ddaa2edb91310f1b379a72fdb59048d8
- SHA1 03cbdc4a15aeb2baf0c90ef808b4e8f31626a7ef
- SHA512 e6a0fb4bf46e678b1fd1c38fe58bb42e3b154b907c193a5c822a9a40206116ef2e90d5e0984156b4e148c31d6dd81772c6c690b5b7461df070687c8c6cde847f
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLNJYH5:1dWubF3n9S91BF3fboJJYH5
- TLSH
  T1EE333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
behavioral25 behavioral26
- Target
  TXPlatforn.exe
- Size 377KB
- SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
- MD5 80ade1893dec9cab7f2e63538a464fcc
- SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
- SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
- SSDEEP 6144:BEo7J1ixs4uVKE9rFEAHKThrBSq2hAzSM5mDo9lSJULHZqExlD2E1LxhJVwIe0Dy:Wo2HQVWAHkFSq2hAWJYlMUtrxlyuJVRq
- TLSH
  T13A841221EB1265A2D30BB0F0CE685F0688B953584C6D1D57EEB51E2D7D3A3EDE832D06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution gh0strat purplefox persistence rat rootkit trojan upx
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Family: PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Gh0st RAT payload
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral27 behavioral28

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Family: Gh0strat

Gh0st RAT payload

Detect PurpleFox Rootkit

Family: Gh0strat

Family: PurpleFox

Gh0st RAT payload

Drops file in Drivers directory

Sets service image path in registry

Executes dropped EXE

Drops file in System32 directory

UPX packed file

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28