gh0strat | bd17fd6f56a0551f25fae747f4c6ed91d81c6c6f5bf272d54d33d2a87dd1a0c8

Sharing

Copy URL Twitter E-mail

General

Target
bd17fd6f56a0551f25fae747f4c6ed91d81c6c6f5bf272d54d33d2a87dd1a0c8
Size 2.9MB
Sample261102-s2kt7sfe54
SHA256 bd17fd6f56a0551f25fae747f4c6ed91d81c6c6f5bf272d54d33d2a87dd1a0c8
MD5 1bd70df6c9cfc0d700f6e577d27f0082
SHA1 3508e4d55587dd745be618987b2948bebeb15092
SHA512 81f5afeeee15e47dc4fb041a016e21736a151ed08634f2b170dd558a0ffdfd5ffa202058b62d0602d4c524cb08e725301a559bc9538e88209ce5307cf74b7edd
SSDEEP 49152:yAWlPUg6Ai935EK6GgZubSTuUUaPmT5lK99GM8CZlhKC9/ZyFc0XnoxL+8v8zrzH:GlPSV36fvZ+suzW0MLrb9IFcsncL+8Kr
TLSH
T116E533F1C5FAA7F97BA2497EBBE409BCB13E02A1B6159A2C011B55C0C4F7D5A07388D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  LinenMark/AuthShell.dll
- Size 83KB
- SHA256 64e9999fccfca6e198f6ddb8dbcbf4b2d919a30606e120e1ab1cdbee64e6c375
- MD5 b994b08132dfbe9083cd45d74a0be058
- SHA1 fd6cda5ac6361bd0168d0f4428b5095f2e522191
- SHA512 d92f42f36558471c7a14d5687e34ca6fc03b280e64d6df0293295400896d0a831e5fbd1ff88e43481aca79c2dbcfb0b5f3f1c06a60b4563f789793f1d02aa48a
- SSDEEP 1536:0CKC7dyrAN39tX/uHzwZXqS5fwwZJoxYsWEcdFY05uX8Uky/o/B:0Dru39ZuHzwVwwrDF/5uMz/B
- TLSH
  T15F836B1076D1E071E9BF19391874CA615B3EB920DEE0DDAB3B4A02690F702D1DE35E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  LinenMark/HFEncrypt.dll
- Size 685KB
- SHA256 5a809c28b39fd44f3dfdbb3a03816ae7fa233ec77aa1fdba9ab3588ced7cb6af
- MD5 979835693ae4980ad3736fbde67e84f2
- SHA1 0c6879a38b53295c33c2d01bcbca743e47b810c9
- SHA512 c5457e6656945ab50e4b0439ec53cfc40554cf0c06487cf29f61d4f35f178c41b944b32b12754d8e64b1f1e2b4de3b8e984d123596fd1a47689bf258f09f6c34
- SSDEEP 12288:xtvYJlocJtuUqn+50w6m4u+5ClB+Lhj42zkUmmu0Rk:3vYJGsNVlB+Lhj5kwu0Rk
- TLSH
  T1FBE48D21F3D3E0B1D59E15B4046DF76C7A6AA8605BB08BD7BBD82B2E5E702C01D3534A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  LinenMark/LinenMark.exe
- Size 1.7MB
- SHA256 12fc4a205783f8b25d24db7407f989c3239348fcc95edd632219ff3dd216c4dd
- MD5 336ad226435e2d2c59b12ee44af62e37
- SHA1 4abcaab7e64b34a5001fdc5596ce589c8135bd75
- SHA512 91d39aaa365415ef9ea8dc630f5de5f519032289a08c359b9c856e6cbbe69b47d7127e0d8271d8548ba173fc83d23459fb1edce4938335465a6e39f358c65046
- SSDEEP 49152:IxhH/C9k/8UC26Xaa6TmAJOY7A2SGZt7S+RooqJchplBdGTqLTFWcZ:IzckLB6l6TmAJOY7A2SGne+OJYplBdGi
- TLSH
  T121859D3136B0807BC23B7531868EE3B9F6BDE9314E35524766905E3D2A35882993877F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution gh0strat rat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0st RAT payload
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  LinenMark/RobinRoundDnsDll.dll
- Size 80KB
- SHA256 0f04961334afd120cf0e508ec214bfd42a3c620eb51edc7be102574ae578af2b
- MD5 57ca58ffa5ac222e9119eb481dad236e
- SHA1 b939741031c1ddd57cfec5dec32de7c4e2b08852
- SHA512 b018525e6f345837ac6f03c80d5f728e08ad1f12177077504bb004d42c26f8d8ac5d5d6e344a8ec5845efb7806af6f46e5f7629eddea410aeb70eb02e25e3149
- SSDEEP 1536:1Wm5QEqLyslUw0Kf63K7eDmp+Kgo54DHdboL7kg:1Wm5QEq70ago5Kkfkg
- TLSH
  T1CF838E317650C072C84B29355469CB722EBEB5315AE4D487BF6A0BBE5F203D1A73934E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  LinenMark/libcurl.dll
- Size 706KB
- SHA256 8fbb6e1c42d6ea9fb1f5651d0cad370cbd36fda89035568c460193b1ae316cdc
- MD5 4b5dfd7e9ac50a741b5ac6102b30cbf5
- SHA1 c3ae8f11f12b2160055a28ee8cd0f14d215864dc
- SHA512 9099874416956b53bb7a8d63a215f0e40ae806d21bdad6fcdba002f35c5b3d8827c7d5e5c9500a356a7bdf7a3d402c3d8851dd0df69a72fed752277f32b210cc
- SSDEEP 12288:Fqqa/+1vVBPwcuhY1N99FvRq9w9+qMA+1Jh7RrvBwXT0cqfswMSm:Mt/+B/Pwc2I99Fg9wozRryXgZb
- TLSH
  T18DF47C61BC81C032D2A3243592BDABB31C7D74322B3499CB639488B95F745D2B73A75B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LinenMark/libeay32.dll
- Size 1.4MB
- SHA256 e1fbb97ff3607d569d584f78ce77a9dd2cf64dca05aebdbf3e55c9711e07b3be
- MD5 ff5c63efbba91a0eec9fc645da655b4c
- SHA1 d225ceff3601b57add69df7d854b2348a8980255
- SHA512 96b963823d7a28e4d4ecd703aa26ad3d3e1d4086e09a4cc08ca88c30c9b8ceb42b7daf184e33b9175f87a566e78028cca3e6ab90ed6537598677f27b15eefce5
- SSDEEP 24576:bP7+KpPGpFwdp51AaHUzrFEUrCrhRgh4fnrvjHnhPUShTuTjCjstP/TqBlkcULQw:7t51AV4/gh4fvpvuOjstP/TqIcULQ3A
- TLSH
  T156659E07BF8199B2E5CF823C91B7977E9D3659119324C9C3CAA129A5CC316E0673F389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  LinenMark/ssleay32.dll
- Size 371KB
- SHA256 f3a288c5455b074fe9c9d5a160adeb49e84bbe1832b5fcbe8f26093215192f65
- MD5 7456818a22dad2c0965580d8bbf4cabd
- SHA1 548714607df2ec3b7c8a22cfba3a1776e6e80861
- SHA512 13f6589bd9c0c60a3df63325c57e94129761adc558d1a65eb4c6e138e6155dd9dbe501d45edde282219dc357593458f5f84a29188d123dcb7770e7479f6a7e68
- SSDEEP 6144:ei2wWNZIpLE8b643WlU03dn3Hg460la0C1bDTQ90IVgcQ7Ab/NXXN7zKDhz+Pi8O:x2wWNZIpLE8b6mWlU03d3Hg460laf1ns
- TLSH
  T19D848E03F68181B3E89A4B74317B6BB62D3E6A015B65C5D3CF60696C8D313C0A73DA9D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Family: Gh0strat

Gh0st RAT payload

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14