Behavioral task
behavioral1
Sample
1e19831c30575b30a18072dbcee1526471dc69d02a2f163814eb489cf7b169ef.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1e19831c30575b30a18072dbcee1526471dc69d02a2f163814eb489cf7b169ef.exe
Resource
win10v2004-20220901-en
General
-
Target
1e19831c30575b30a18072dbcee1526471dc69d02a2f163814eb489cf7b169ef
-
Size
486KB
-
MD5
6b0cd3d2c7d0b8402c696d907fe35af0
-
SHA1
2a74161d169ea8093d407d94c5fefeb58f327776
-
SHA256
1e19831c30575b30a18072dbcee1526471dc69d02a2f163814eb489cf7b169ef
-
SHA512
969dbfbdf6d8e362c9acf3438d56d581a5b24fdba0340eba7ea49a3c507f7b0dcbc82fd6252f33b7b24aed45982d65af269dbfda287cd07f2464964ee7bb4e21
-
SSDEEP
12288:pwjsRhu1bCJH9JnX181KTu2jW0N1sAEuANBxI/RJgDvQ:mjsnu1+JH9JX18QTfW0sAvwBxInMv
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
resource yara_rule sample aspack_v212_v242 -
resource yara_rule sample upx
Files
-
1e19831c30575b30a18072dbcee1526471dc69d02a2f163814eb489cf7b169ef.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 672KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 328KB - Virtual size: 332KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ffblog Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE