Behavioral task
behavioral1
Sample
7166d4c2ed991a6cded48bef4062abda32692da2a7b957f36e5d03898ada18d3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7166d4c2ed991a6cded48bef4062abda32692da2a7b957f36e5d03898ada18d3.exe
Resource
win10v2004-20220812-en
General
-
Target
7166d4c2ed991a6cded48bef4062abda32692da2a7b957f36e5d03898ada18d3
-
Size
985KB
-
MD5
1538465c377a5473c6b5bde1a330b3f0
-
SHA1
7a2d9e2d96fed40835217ee3db4500a21e874cad
-
SHA256
7166d4c2ed991a6cded48bef4062abda32692da2a7b957f36e5d03898ada18d3
-
SHA512
7ed675db6cf6fcd101332fc1e2cf0e9401c090eb6029c49de8edf0c3b03bf43ea818ec828edb44acea16da579c7dd37370dd9a0d9467bd5e0e018ae49f603b1e
-
SSDEEP
24576:Yod1twGwkR3PIx7DBoe1twGCLzNys6Fkk:lDw+CnDOU
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
7166d4c2ed991a6cded48bef4062abda32692da2a7b957f36e5d03898ada18d3.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.!rc! Size: 171KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ChW8avWh Size: 3KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
OZNFY7Rg Size: 300KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IHJ3KUI5 Size: 294B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0ICFj14c Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.AoRE Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 279KB - Virtual size: 279KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xur Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE