Behavioral task
behavioral1
Sample
445393e44894fd58740e17a683d8ad0a199638e35817aa6ea058557a0b10d7e8.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
445393e44894fd58740e17a683d8ad0a199638e35817aa6ea058557a0b10d7e8.exe
Resource
win10v2004-20220812-en
General
-
Target
445393e44894fd58740e17a683d8ad0a199638e35817aa6ea058557a0b10d7e8
-
Size
196KB
-
MD5
4dfdb0dce62809a913f4b95490c6b037
-
SHA1
5da70425f53febb8adb43b7508c370c1ea61b40a
-
SHA256
445393e44894fd58740e17a683d8ad0a199638e35817aa6ea058557a0b10d7e8
-
SHA512
e3e0351fe9cc4d621b1ee5ba957be3919da18a9a277a1e4a41a66234aa54d13bb35ba526360756fbd6193246cdba431be0a20d493350e086d119467e4e519b8d
-
SSDEEP
6144:vsIt6nW8QUBTyPRqyhYPbHcTBlhHrDndnkv0:k9W8YJq8YPbHcT3i
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
445393e44894fd58740e17a683d8ad0a199638e35817aa6ea058557a0b10d7e8.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
CODE Size: 18KB - Virtual size: 18KB
Size: 166KB - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata2 Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA