Behavioral task
behavioral1
Sample
20909fa69006d365cbaf190942f9c5baac1c7206067780293d4ae16b5a6b467d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
20909fa69006d365cbaf190942f9c5baac1c7206067780293d4ae16b5a6b467d.exe
Resource
win10v2004-20220812-en
General
-
Target
20909fa69006d365cbaf190942f9c5baac1c7206067780293d4ae16b5a6b467d
-
Size
38KB
-
MD5
8000653ba8da2a01a2641b1fc67930b0
-
SHA1
063c31033ae660ea2671418ccfa51c1e08cf6cd9
-
SHA256
20909fa69006d365cbaf190942f9c5baac1c7206067780293d4ae16b5a6b467d
-
SHA512
7a7f3ef81e61e77ab6fb011459d694b8a81a5f757c0f4142cb205939ceba63fa0e917bfd1f261739a98eddba8e25d11fa51fee943a7edcc16c61406291049f4b
-
SSDEEP
768:1LhAoYWXrM4dyaCHS3Se8meiDpMcUlJqwrYCq/GR8zs4HJtx5CMm7:1LhbrMHaCaZeiDacU+wknOWXHK
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
20909fa69006d365cbaf190942f9c5baac1c7206067780293d4ae16b5a6b467d.exe windows x86
e03e0781750325aa37c9b556a7d5c0a7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetProcAddress
GetModuleHandleA
HeapAlloc
GetProcessHeap
GetLastError
lstrcatA
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
GetSystemDirectoryA
DeleteFileA
MoveFileA
FreeResource
CloseHandle
WriteFile
SizeofResource
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
LoadResource
FindResourceA
GetTickCount
GetTempPathA
lstrlenA
GetModuleFileNameA
SetUnhandledExceptionFilter
Sleep
ReleaseMutex
CreateMutexA
GetCommandLineA
GetCurrentThreadId
lstrcpyA
SetLastError
LoadLibraryA
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
msvcrt
memset
strlen
??3@YAXPAX@Z
strstr
memcpy
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_CxxThrowException
__CxxFrameHandler
_except_handler3
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 89KB - Virtual size: 89KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ