Behavioral task
behavioral1
Sample
1ff4c987b6701ba19fbbcfc472f07b944f1652bb01fc89c05b10ab88bbce60df.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1ff4c987b6701ba19fbbcfc472f07b944f1652bb01fc89c05b10ab88bbce60df.exe
Resource
win10v2004-20220901-en
General
-
Target
1ff4c987b6701ba19fbbcfc472f07b944f1652bb01fc89c05b10ab88bbce60df
-
Size
176KB
-
MD5
a62f5859712ea18646ec8ac1332ca088
-
SHA1
c8d7e14d66d8444c425b97b58f94a291470f5729
-
SHA256
1ff4c987b6701ba19fbbcfc472f07b944f1652bb01fc89c05b10ab88bbce60df
-
SHA512
32384620dcc29e59782d286f1fee5b4dc8e6ca40fa3c1e203be8f7099c10347344d0f82c71598158cae0f65de0bb278b7e1f3678f0974b83c9db581f8329dc68
-
SSDEEP
3072:t0LPHByYgf6+4Ayv/gCBw8YaQw3g0c8e1IPiU5wCSLEfZSj3Go6SONCb:GNypf6+owC6TFw3g0cT1IPiUsEhSj3Vn
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
1ff4c987b6701ba19fbbcfc472f07b944f1652bb01fc89c05b10ab88bbce60df.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.n4sp40 Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.n4sp41 Size: 48KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.n4sp42 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE