Behavioral task
behavioral1
Sample
35cf15a28d2f855a9b1327216c0d1b4005c2520a72f9de878bd99b431a7bf220.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
35cf15a28d2f855a9b1327216c0d1b4005c2520a72f9de878bd99b431a7bf220.exe
Resource
win10v2004-20221111-en
General
-
Target
35cf15a28d2f855a9b1327216c0d1b4005c2520a72f9de878bd99b431a7bf220
-
Size
33.1MB
-
MD5
a76d620679d4f472c91f5d87e5348a77
-
SHA1
157e10a022569fc89a2c0e5eadb2aefb027e1bf6
-
SHA256
35cf15a28d2f855a9b1327216c0d1b4005c2520a72f9de878bd99b431a7bf220
-
SHA512
df3532c357cdd62a592b6f6936e715cac24b2860c9b2776c2217f6265595c5b153c510afd04ed79be25590025ada9819ea1c9bc3ea874a054808c13a2463e49c
-
SSDEEP
3072:PaG4J08OAnW5tC5Cl0jStFcJbzbUaEtdznYgaa8OdYRGKOkN8:Pv4J08J5CtFcRUaEttZazoqO+
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
35cf15a28d2f855a9b1327216c0d1b4005c2520a72f9de878bd99b431a7bf220.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 112KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ