Extracted

• • Target
    2026-11-09_0af0f95588e4ebdadc1b139cb8eb06b4_amadey_dark-comet_darkgate_elex_emotet_gcleaner_glassworm_hellokitty_luca-stealer_njrat_remcos_rhadamanthys
  • Size 4.3MB
  • SHA256 654eeaee973ce2d73b29b63dd1c5dc8b53f42201e7eef9a899f616b370a7d823
  • MD5 0af0f95588e4ebdadc1b139cb8eb06b4
  • SHA1 12bcb4d550ee1d536db2177e8fa50d037e198623
  • SHA512 1b8edeb7c116c8ec9070d213006ba0a3bebb543841ec9b33d64e113082a2c2cc44cba30075cd3cc01cfb5be2ed04cfa7b30efb6125472eb86d695070a6bf844f
  • SSDEEP 98304:unsmtk2ak2SVMD8Onsmtk2a/ix/7/4PzV3dlA8j:wLxCLr7gPBNlxj
  • TLSH
    T15F26E132F6D18072C53216348CAB97B5993EBF501E34694F37ECBE1C5E3628269352A7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordefense_evasiondiscoverygh0stratxredpersistenceprivilege_escalationratspywarestealer

  • Family: Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Family: Xred

    Xred is backdoor written in Delphi.

    backdoorxred

  • Gh0st RAT payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2