Behavioral task
behavioral1
Sample
b87a8892a9c2022945f06c3ff02fd2c776907b30f96b8644f4a7cb581009d924.exe
Resource
win7-20220812-en
General
-
Target
b87a8892a9c2022945f06c3ff02fd2c776907b30f96b8644f4a7cb581009d924
-
Size
196KB
-
MD5
2af9eb3313bfc375a32e6ec5fa85bf0a
-
SHA1
30020879df00bb9e2e51866d40d9af2475ad2f61
-
SHA256
b87a8892a9c2022945f06c3ff02fd2c776907b30f96b8644f4a7cb581009d924
-
SHA512
27e0cba015d08abb499a6c1d0123eb30b3022ff6b17e33f6ab17e923e077fdccd4e1fbaad5e4c4b81fcf9f3ddf0dcc79de07cd4bfd845950c13bf82d93c09e5c
-
SSDEEP
6144:rKnQu0Y3QhbIDlu24SPFQwXNC2Z6yqFLsTQLK:rKn1ZghbU14KF0kgFLyo
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
b87a8892a9c2022945f06c3ff02fd2c776907b30f96b8644f4a7cb581009d924.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
nsp0 Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nsp1 Size: 64KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE