Behavioral task
behavioral1
Sample
4e8b6a9d8a1dc59ddf632951604b8bce1311c49e591dc2f60f93275a7a30d00c.dll
Resource
win7-20220812-en
General
-
Target
4e8b6a9d8a1dc59ddf632951604b8bce1311c49e591dc2f60f93275a7a30d00c
-
Size
896KB
-
MD5
0d58e7143b02d9bcca295061f0ae2490
-
SHA1
0c0538df7ac97ab1017ec36377d36a0443ba66fc
-
SHA256
4e8b6a9d8a1dc59ddf632951604b8bce1311c49e591dc2f60f93275a7a30d00c
-
SHA512
c362002e2b116bbfdc86c80e4460feac91b5dcb797e8cbdb65603d631a3dffc8b8f330de4e204b79461da6ce13ed0059c866d6f76dd810a908b4136a9fdbff5f
-
SSDEEP
24576:v0tWHZKT3qMxABv0AKyZLDP12dOuQ0uitur:5HZKTaMxODP1LuQ2
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
4e8b6a9d8a1dc59ddf632951604b8bce1311c49e591dc2f60f93275a7a30d00c.dll windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
_FLAT Size: 884KB - Virtual size: 884KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.imports Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ