Behavioral task
behavioral1
Sample
8beb8395b407d207b3db4ffbafdb81b86ba31e523d2c18b4e8c092ae9c5e47b4.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8beb8395b407d207b3db4ffbafdb81b86ba31e523d2c18b4e8c092ae9c5e47b4.exe
Resource
win10v2004-20220901-en
General
-
Target
8beb8395b407d207b3db4ffbafdb81b86ba31e523d2c18b4e8c092ae9c5e47b4
-
Size
320KB
-
MD5
fc15810bc7953982bec29c21d9867535
-
SHA1
daa062647a2af1a5cdc2c2f508826fc3b65f9f4e
-
SHA256
8beb8395b407d207b3db4ffbafdb81b86ba31e523d2c18b4e8c092ae9c5e47b4
-
SHA512
12d5569cd4d5d3cd2fe30832c9c2f871a0f3dc3c73d7ba563d2db2dd198504aa2331d5a1d9d3503bdd25872fc65c7babdcdb2b98607729e44c88912150230f3b
-
SSDEEP
6144:UiFtiWB0WL7tLJ5ip34GyYN4G7v4G7AWFi:DtB0WdLriNFVJA7
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
8beb8395b407d207b3db4ffbafdb81b86ba31e523d2c18b4e8c092ae9c5e47b4.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ