Behavioral task
behavioral1
Sample
7c478bc40c3de167da3ab81854482d23076bab9563143a65c66bc2f71e950f6b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7c478bc40c3de167da3ab81854482d23076bab9563143a65c66bc2f71e950f6b.exe
Resource
win10v2004-20220812-en
General
-
Target
7c478bc40c3de167da3ab81854482d23076bab9563143a65c66bc2f71e950f6b
-
Size
120KB
-
MD5
a2b5f05f5f0941cb1324e8289ec19e01
-
SHA1
f8ef3dc77610ed2fdc8da800c704b452f16ae807
-
SHA256
7c478bc40c3de167da3ab81854482d23076bab9563143a65c66bc2f71e950f6b
-
SHA512
8650d80e67280476546d09a52aa16ec3dc3154ae187d4b537d1630bf0e1bd56ab81791fecc9ef45c6149603ddec1d80c48227dc622e9fa9f1cf17bb9a35e9424
-
SSDEEP
1536:gK78uF7b9y0sRToSF09fElSwkDl91h2gAc38qfslciH+IQSzohftOf:gPuFP9wPK9fHwkDygAs8sslciQSz4tI
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
7c478bc40c3de167da3ab81854482d23076bab9563143a65c66bc2f71e950f6b.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 84KB - Virtual size: 82KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ