Behavioral task
behavioral1
Sample
ce1aeccd01ec870e7066b80ab23a4002585293b2775004e9b7618473ffa90636.exe
Resource
win7-20220901-en
General
-
Target
ce1aeccd01ec870e7066b80ab23a4002585293b2775004e9b7618473ffa90636
-
Size
136KB
-
MD5
0d268ecbc52fdf5c30d3f8f6eb606eb0
-
SHA1
cf2ea4ececa3db3e253104af7203d086a9204fb7
-
SHA256
ce1aeccd01ec870e7066b80ab23a4002585293b2775004e9b7618473ffa90636
-
SHA512
2d673640cce8c92629d674b917477b4041aa7244f2e6f402ada51fc4f61d5dedc943e1bb62928cf8338cc9e30f2b2f31d4e382b77a98054b07c86c9e8fe3e826
-
SSDEEP
3072:Eu/Ln6sIZ8z9p5EXoHFT/e4pgncIsIf0LlCYUJvr7Zk6:f/Ln6sy8z9jEXoHFC47S0x6Jv
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
ce1aeccd01ec870e7066b80ab23a4002585293b2775004e9b7618473ffa90636.exe windows x86
c169793c86e0f7cd7bf98e45c4ebc6db
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetUnhandledExceptionFilter
Sleep
ReleaseMutex
CreateMutexA
GetSystemDirectoryA
GetCurrentThreadId
GetStartupInfoA
GetModuleHandleA
Process32First
Process32Next
MoveFileA
CreateDirectoryA
CopyFileA
SetFileAttributesA
GetModuleFileNameA
CreateFileA
SetFilePointer
ReadFile
DeleteFileA
GetFileAttributesA
lstrcatA
GetLastError
GetTempPathA
FreeLibrary
SetLastError
lstrcmpiA
lstrcpyA
LoadResource
SetFileTime
SizeofResource
lstrlenA
CloseHandle
MultiByteToWideChar
ExitProcess
GetWindowsDirectoryA
LoadLibraryA
GetProcAddress
GetCommandLineA
user32
GetMessageA
wsprintfA
PostThreadMessageA
GetInputState
advapi32
GetSecurityDescriptorDacl
OpenServiceA
StartServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetFileSecurityA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA
shell32
ShellExecuteA
msvcrt
_XcptFilter
_strcmpi
_strrev
strtok
??2@YAPAXI@Z
strchr
_except_handler3
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
realloc
malloc
fclose
fputs
fopen
strstr
??1type_info@@UAE@XZ
_exit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
netapi32
NetUserGetLocalGroups
NetApiBufferFree
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 111KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hnxyy Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE