Behavioral task
behavioral1
Sample
db871fa9d58740826e48bf8835b6270559a49d1cf271a76edf8ac73366174c08.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
db871fa9d58740826e48bf8835b6270559a49d1cf271a76edf8ac73366174c08.exe
Resource
win10v2004-20220812-en
General
-
Target
db871fa9d58740826e48bf8835b6270559a49d1cf271a76edf8ac73366174c08
-
Size
328KB
-
MD5
82747a610294f4d2b395a0f521edd962
-
SHA1
f0387c1b9c5c9bd56e35711e3b90fe3a56fb15fe
-
SHA256
db871fa9d58740826e48bf8835b6270559a49d1cf271a76edf8ac73366174c08
-
SHA512
9e8a0c9549249af86b067a971e136ff7209c40a7b110ca66eb227b0f99e88fb5d92a79392d545e1e5799ee643540841ede61b6d6f5b068718ebc14981584e56e
-
SSDEEP
6144:giTtiWO0sL7trJ5pp34OZK4G7v4G7AWFv5:vXO0sdrrpNtKJAq
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
db871fa9d58740826e48bf8835b6270559a49d1cf271a76edf8ac73366174c08.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ