Overview

overview

10

Static

static

3

9fd93ef3b2...6c.exe

windows7-x64

10

9fd93ef3b2...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c

  • Size

    376KB

  • Sample

    240701-f2zl5sxdje

  • MD5

    eb2e46cafe688c41e19a25233029e8fc

  • SHA1

    189ddd1a812ad0647dde7f214cd7379764fb838d

  • SHA256

    9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c

  • SHA512

    b6bdeccec77cd82bb9d34947f63983994b5e5ad8647bdce80dcb28501deb8c6b3708e847349f3fe25581baf0b13984647b2d74a01e6c392aefae22304d5c9a2d

  • SSDEEP

    3072:RvK/yLrQbWaR5Qax8c/Ytzyxy+Pb9gcamf/w5vtc009w60wbA0X:ROyLEbWaR5CcLTPb9gc16LKLbN

Score
10/10
gh0stratpersistencerat

Malware Config

Extracted

Family

gh0strat

C2

103.143.46.17

Targets

    • Target

      9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c

    • Size

      376KB

    • MD5

      eb2e46cafe688c41e19a25233029e8fc

    • SHA1

      189ddd1a812ad0647dde7f214cd7379764fb838d

    • SHA256

      9fd93ef3b23367d775e16c7cf684705d77467395ac6e26c916bfe39e44f46f6c

    • SHA512

      b6bdeccec77cd82bb9d34947f63983994b5e5ad8647bdce80dcb28501deb8c6b3708e847349f3fe25581baf0b13984647b2d74a01e6c392aefae22304d5c9a2d

    • SSDEEP

      3072:RvK/yLrQbWaR5Qax8c/Ytzyxy+Pb9gcamf/w5vtc009w60wbA0X:ROyLEbWaR5CcLTPb9gc16LKLbN

    Score
    10/10
    gh0stratratpersistence

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks