Behavioral task
behavioral1
Sample
0ec02a267bd92bab5041e851af7eb284b6b3e8ddfbc6d971f96195637ca215c4.exe
Resource
win7-20220812-en
General
-
Target
0ec02a267bd92bab5041e851af7eb284b6b3e8ddfbc6d971f96195637ca215c4
-
Size
111KB
-
MD5
8191ec99515c8b36c870b53402d0bc00
-
SHA1
ce2097429ca76ae86e73b9097db5d24a0a9b0847
-
SHA256
0ec02a267bd92bab5041e851af7eb284b6b3e8ddfbc6d971f96195637ca215c4
-
SHA512
4c5fefcce0627d59c982f1f8c62acb7f486d88d1c36d24b76ddd57dcf0d778b0100289f2ab08af850909fb0033dcc4764c44a1bc125740d72a78f9b2eb6b52aa
-
SSDEEP
3072:KQYPX1Sp7+tFDZzxqE/34pEX9ybZuwB+ky:SEoFDB3E8UZuwB+l
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
0ec02a267bd92bab5041e851af7eb284b6b3e8ddfbc6d971f96195637ca215c4.exe windows x86
79b3362178937bf9559741c46bb9e035
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetProcAddress
Sections
.Love@YT Size: - Virtual size: 124KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Love@YT Size: 111KB - Virtual size: 111KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE