Behavioral task
behavioral1
Sample
cd4f4104155704b19ad1b05171df882978e874305f19d20e59054e95bfafd958.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cd4f4104155704b19ad1b05171df882978e874305f19d20e59054e95bfafd958.exe
Resource
win10v2004-20220812-en
General
-
Target
cd4f4104155704b19ad1b05171df882978e874305f19d20e59054e95bfafd958
-
Size
328KB
-
MD5
078e10f196476af2ea7d1264a52fe100
-
SHA1
e2d3a38d5eb823e0886e64b68d1955392ab48b5e
-
SHA256
cd4f4104155704b19ad1b05171df882978e874305f19d20e59054e95bfafd958
-
SHA512
68ee90ca304ef61dc2f02fb30e250c2672c0269d0225c483d656312e24ef9deb48653c48376c7a5e815f80e137016a4016b40ee946620c22a7eceec74a1b8bc6
-
SSDEEP
6144:miFtiWB0WL7tNJ5ip3GaVmju4G7vIG7AWF7L/F9B0KY8nP:dtB0WdNriNbsM5AcL/Ff0KY8nP
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
cd4f4104155704b19ad1b05171df882978e874305f19d20e59054e95bfafd958.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 138KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ