Behavioral task
behavioral1
Sample
044be76bba111443d36460472a41b094204489707ffa7b8daf8df0fc6e520d93.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
044be76bba111443d36460472a41b094204489707ffa7b8daf8df0fc6e520d93.exe
Resource
win10v2004-20220812-en
General
-
Target
044be76bba111443d36460472a41b094204489707ffa7b8daf8df0fc6e520d93
-
Size
316KB
-
MD5
3929f994006d070cd12e77ee12d14635
-
SHA1
4713bd12a59d1fb78276999965b4b7406bb0cbca
-
SHA256
044be76bba111443d36460472a41b094204489707ffa7b8daf8df0fc6e520d93
-
SHA512
316da0e220bcdf7991b01a8dc648d06c70badc41a650027eda290913541f091264f670ddd9cec9444f9bac2ef31935b6089e0d1a38e92f7d24e562fcb2b03c4a
-
SSDEEP
6144:BiTMIWB0AL7tLm5Tlp34knw04G7v4G7AWFR:EiB0AdLuZNbweJAu
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
044be76bba111443d36460472a41b094204489707ffa7b8daf8df0fc6e520d93.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ