Behavioral task
behavioral1
Sample
82f1fc3d25d6e3f15298a2c7d473be2bad4a5ac8147b4043edf73dca7d4f7838.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
82f1fc3d25d6e3f15298a2c7d473be2bad4a5ac8147b4043edf73dca7d4f7838.exe
Resource
win10v2004-20220812-en
General
-
Target
82f1fc3d25d6e3f15298a2c7d473be2bad4a5ac8147b4043edf73dca7d4f7838
-
Size
113KB
-
MD5
5614756931bff539ff89cb1ebbd4453f
-
SHA1
61a674f6054fdc44c86599f511004a947d07d13f
-
SHA256
82f1fc3d25d6e3f15298a2c7d473be2bad4a5ac8147b4043edf73dca7d4f7838
-
SHA512
4d3a06b8c47905b6b10d8be3833505367d8a5fc8be5a4602ea6d05f326b75477543f2ae8452ebf2500d2d20a38c13f1abaedaf1a79cc6aa1dc0dbbd64e62b2d4
-
SSDEEP
3072:4bTlJvWmS7mbySjzk9yYxtMBU8Ww0FsxXGks4lfza2f1:43lJumkmbySjzxmMW7w0GxXps4lfza2d
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
82f1fc3d25d6e3f15298a2c7d473be2bad4a5ac8147b4043edf73dca7d4f7838.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.MaskPE Size: 2KB - Virtual size: 1KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MaskPE Size: 2KB - Virtual size: 1KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MaskPE Size: 2KB - Virtual size: 1KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MaskPE Size: 2KB - Virtual size: 1KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ