Behavioral task
behavioral1
Sample
a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a.exe
Resource
win10v2004-20220812-en
General
-
Target
a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a
-
Size
204KB
-
MD5
0605b275f82fca535c7b2296d19c9ca0
-
SHA1
3d30333cba7aae765e37a0704b4f9bb7f309c063
-
SHA256
a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a
-
SHA512
3632a6b8f7fe0f626a583b0546df25f36b2082770c63e7e2205cda9ab058e06b52125100a15d7fdff329f98848b341f15f1949b52665bf3bbe81cac6f9496dd6
-
SSDEEP
6144:WG5/yQ1/h46Fl0E76QQNUTBl2pqPK1Rpa:WcyuhRFN76ZUT3kxvY
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
a12ad615982486d892c34de1a14f8b947428f7696eab73eae59b3cae4fbfd68a.exe windows x86
ba6ec1f01dad211205728aa6b0b1dcad
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetProcAddress
GetModuleHandleA
HeapAlloc
GetLastError
LoadLibraryA
ExitProcess
SizeofResource
LockResource
LoadResource
lstrcpyA
lstrlenA
lstrcmpiA
SetLastError
GetEnvironmentVariableA
lstrcatA
GetShortPathNameA
GetModuleFileNameA
CreateThread
MoveFileExA
WinExec
CloseHandle
WriteFile
CreateFileA
GetLocalTime
SetUnhandledExceptionFilter
Sleep
GetCommandLineA
GetCurrentThreadId
GetStringTypeA
LCMapStringW
FreeLibrary
LocalAlloc
InterlockedExchange
RaiseException
RtlUnwind
HeapReAlloc
GetStartupInfoA
GetVersion
VirtualFree
VirtualAlloc
IsBadWritePtr
GetVersionExA
HeapDestroy
HeapCreate
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetStdHandle
FlushFileBuffers
SetFilePointer
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
ReadFile
MultiByteToWideChar
LCMapStringA
GetStringTypeW
shell32
ShellExecuteA
Sections
PAGE Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 28KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 144KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ