Behavioral task
behavioral1
Sample
bdb0b9d2235a65881123d137a2217cd71c80cfec522cbeb91f17dd67a13c024c.exe
Resource
win7-20220901-en
General
-
Target
bdb0b9d2235a65881123d137a2217cd71c80cfec522cbeb91f17dd67a13c024c
-
Size
112KB
-
MD5
dfa699eb126e26d6f133367b98cf44e1
-
SHA1
c908ea87b5a7761dec69a025bd74c5c7639a8cd7
-
SHA256
bdb0b9d2235a65881123d137a2217cd71c80cfec522cbeb91f17dd67a13c024c
-
SHA512
236b32b0f113352a45d7f64557f330d0a646dfa406266403116bd7c8e14bf113fe5d5ee2d24c868aa5536984b7d888f12ec4c3dd44c3f38feb02a9ac301579fa
-
SSDEEP
3072:CSuNfYQg/wMkmUQctaceqqtc3/f1IkUMgYUL:CScYD/wn9a/Pqf1HUMm
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
bdb0b9d2235a65881123d137a2217cd71c80cfec522cbeb91f17dd67a13c024c.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 99KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�� Size: 2KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE