Behavioral task
behavioral1
Sample
384e0b6785c05bbb4bd0df88e73bddfb9239fbaa75da07b3bd15be3585bd3ab3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
384e0b6785c05bbb4bd0df88e73bddfb9239fbaa75da07b3bd15be3585bd3ab3.exe
Resource
win10v2004-20220812-en
General
-
Target
384e0b6785c05bbb4bd0df88e73bddfb9239fbaa75da07b3bd15be3585bd3ab3
-
Size
292KB
-
MD5
607200fef4546fcfcfd9134c575ff56a
-
SHA1
32943a9f46d57114316910be2266159e6a5b0132
-
SHA256
384e0b6785c05bbb4bd0df88e73bddfb9239fbaa75da07b3bd15be3585bd3ab3
-
SHA512
4b28e552d8538d5af6536312aded924e321590d40d151f692974b25c82d032cff52b9d504a6808abd897c4ed6b6f4c967510bd59c4ffa9314a1d96a0b3bc2275
-
SSDEEP
6144:z2Rnh5EsIm2EJ7RkYQRWp06i4G7CzcF7b:zeh5EsIYJdkPUpkCu
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
384e0b6785c05bbb4bd0df88e73bddfb9239fbaa75da07b3bd15be3585bd3ab3.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 148KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ