Behavioral task
behavioral1
Sample
e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe
Resource
win10v2004-20220812-en
General
-
Target
e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b
-
Size
156KB
-
MD5
638d922d3a1acb3756dda409b8b50700
-
SHA1
6c416852f4c750931281b76fa6e69a9996da7882
-
SHA256
e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b
-
SHA512
a5e400a843be5b102be00a5fb30f96970d7b18f2f2259fadd2c6e721461ceacd0239737f05bfae6348887d03e5c81f89505e28cd75d09e5c6240607acb325d6a
-
SSDEEP
3072:dVZd5rnmoWOQrkdJv5hMFULTvtcMk8Lyji8lkivl05Kui+ITqn:dXd5rmoWOQsJRG4GMkSQi8Tvl05KuDIk
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
e1691bda323c46c3dd3926b242861fb88452191742395365c48c38a454da916b.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.data Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ