Behavioral task
behavioral1
Sample
9f35e456262087f202d7f442284f833db8c0a72f3aabaf9ef51fb76e440fb0ba.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9f35e456262087f202d7f442284f833db8c0a72f3aabaf9ef51fb76e440fb0ba.exe
Resource
win10v2004-20220812-en
General
-
Target
9f35e456262087f202d7f442284f833db8c0a72f3aabaf9ef51fb76e440fb0ba
-
Size
128KB
-
MD5
007f164334b4efffa1acb6cb8a564070
-
SHA1
a69c6738f3d1a2611977f170fd75ca33fbd4d324
-
SHA256
9f35e456262087f202d7f442284f833db8c0a72f3aabaf9ef51fb76e440fb0ba
-
SHA512
5729288661ace69515c8ba29878bc1544275305c1bce16732b593a00b68f76e73da96b2c3fd63caea1518dd3b4dce0ae8fb8d4b3b88a5649573263344c130033
-
SSDEEP
3072:Qk0Cq/Bso78+T4CkTLf1d46qhC+FxCbl2ja61:brMBn7ACk/tJqoMx82ja
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
9f35e456262087f202d7f442284f833db8c0a72f3aabaf9ef51fb76e440fb0ba.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ