Behavioral task
behavioral1
Sample
0e159716ac04db5eae1c3cc12acadecf680b8e0cb2345ece792501c49b514489.exe
Resource
win7-20220812-en
General
-
Target
0e159716ac04db5eae1c3cc12acadecf680b8e0cb2345ece792501c49b514489
-
Size
289KB
-
MD5
0851c5d00a54c8dfbc5d47ea0a6af4c0
-
SHA1
386525a8d95a7bf87ce24ff54de83ccb4aee77b1
-
SHA256
0e159716ac04db5eae1c3cc12acadecf680b8e0cb2345ece792501c49b514489
-
SHA512
a40f62b3be51771bd368db4b6833c68b377ea9faa2616dfa29f8122d5f704a64fc13c5ae69c2b9703590fe1109fc288dd97b8e5f43c1d031361d1d2f79859448
-
SSDEEP
1536:BYwvQr1RDIbmgPcr7/TfhSMLLMcd7YiytuSpIAG9621GJyY:e319amgPc/zhSMLLMcd7YiytuTp9P1
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
0e159716ac04db5eae1c3cc12acadecf680b8e0cb2345ece792501c49b514489.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uisrsia Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE