Behavioral task
behavioral1
Sample
9a9945ba69a7033147a42ffadcd905344055700f8d9a565307358334ef87f75a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9a9945ba69a7033147a42ffadcd905344055700f8d9a565307358334ef87f75a.exe
Resource
win10v2004-20221111-en
General
-
Target
9a9945ba69a7033147a42ffadcd905344055700f8d9a565307358334ef87f75a
-
Size
172KB
-
MD5
2a2c93d821267fd128501be451994674
-
SHA1
4c4b6022ade495fa917db6f8b0a3ca2049e741a7
-
SHA256
9a9945ba69a7033147a42ffadcd905344055700f8d9a565307358334ef87f75a
-
SHA512
b6c923ed0b5ce3de123e637099a6ddf408e592bd527090190f48958f1c0d28f02035eed5b59849e33f28fbcc68f40c9046222b4fe287adb6d666b75a2cc72d49
-
SSDEEP
3072:EIXD6t2GloVFwz8BD0cjRTyVwdUE3AZnC69NJ09sTpw6:E3lQwz8BDpWwOUA1C6rTu6
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
9a9945ba69a7033147a42ffadcd905344055700f8d9a565307358334ef87f75a.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 129KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ