Behavioral task
behavioral1
Sample
bdaaab783efeff8720e3f205b029cadce4234d56652a466c13845b585cc9ba1a.exe
Resource
win7-20220901-en
General
-
Target
bdaaab783efeff8720e3f205b029cadce4234d56652a466c13845b585cc9ba1a
-
Size
91KB
-
MD5
c9a3b345e6651d1d8754f6f56655bc7a
-
SHA1
737416021318ac398785ea33d8c6411328cae4ee
-
SHA256
bdaaab783efeff8720e3f205b029cadce4234d56652a466c13845b585cc9ba1a
-
SHA512
70ac3781ad83a35d4299ad18db207ca12f0d7c6b3eafa2f280a4eee9abb8fabafbbc48cbed5e220fd606cefcdc46fc6207aef577ae6cdaaddc48059219b32782
-
SSDEEP
1536:ITjc/BLOj7TixMyruZS6jhLvTm6zfwg0jMczMBfiOOaw0YFvjN+dH+hGt3/:zBLOj7exM171fwg0jMQMxiOOt0YFvjNm
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
bdaaab783efeff8720e3f205b029cadce4234d56652a466c13845b585cc9ba1a.exe windows x86
535bbb1d174e3a4f1ce019d6604972ab
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReadProcessMemory
Module32First
CreateToolhelp32Snapshot
CreateProcessA
Process32Next
lstrcmpiA
Process32First
LoadLibraryA
lstrcatA
GetLastError
lstrlenA
lstrcpyA
SetLastError
GetCommandLineA
GetStartupInfoA
GetProcAddress
GetModuleHandleA
FreeLibrary
TerminateProcess
DeleteFileA
GetWindowsDirectoryA
GetProcessHeap
HeapAlloc
HeapFree
CreateThread
Sleep
ExitProcess
CloseHandle
user32
GetWindow
GetWindowTextA
EnumWindows
MessageBoxA
wsprintfA
PostQuitMessage
DefWindowProcA
DestroyWindow
GetDesktopWindow
GetMessageA
PostThreadMessageA
GetInputState
CreateWindowExA
RegisterClassExA
LoadImageA
SendMessageA
msvcrt
_CxxThrowException
_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
strstr
malloc
_except_handler3
strchr
??2@YAPAXI@Z
__CxxFrameHandler
_strnset
??3@YAXPAX@Z
??1type_info@@UAE@XZ
_exit
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 77KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ