Behavioral task
behavioral1
Sample
15220cac65f86e2639f8be97b5108324d4595b14670fea58ddf4308de92d482c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
15220cac65f86e2639f8be97b5108324d4595b14670fea58ddf4308de92d482c.exe
Resource
win10v2004-20220812-en
General
-
Target
15220cac65f86e2639f8be97b5108324d4595b14670fea58ddf4308de92d482c
-
Size
311KB
-
MD5
905c3211af0112154c98baa8bde3af2b
-
SHA1
5848b87f2f4ac6c154234584ed813377bbd5899b
-
SHA256
15220cac65f86e2639f8be97b5108324d4595b14670fea58ddf4308de92d482c
-
SHA512
fb1f38313c89e08a332dafcc6a73989abfc44807c2f5a64c11b1b7f0583ca4c4320855efa458790015caf0f9d898b06d6deff73dbd2c5689db06760e86634648
-
SSDEEP
6144:OWT1Ic+fciN3xjXoxrjxvcOMjuaMSiQ+EeEXMwQe8zLZ44Hpx14hxH:H1IZUEj0BOjqdLEeEVh8HZBp8h5
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
15220cac65f86e2639f8be97b5108324d4595b14670fea58ddf4308de92d482c.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ifc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE