Behavioral task
behavioral1
Sample
cdb348812f6840a8802a064ffd3203f7b29cb79548f6271c704ebfc7e2bbfa0e.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cdb348812f6840a8802a064ffd3203f7b29cb79548f6271c704ebfc7e2bbfa0e.dll
Resource
win10v2004-20221111-en
General
-
Target
cdb348812f6840a8802a064ffd3203f7b29cb79548f6271c704ebfc7e2bbfa0e
-
Size
114KB
-
MD5
8549f8a32f9f408fd20008ef7d807e83
-
SHA1
47164d11c104a9bf5e6d7ff0c7abf20de1ad6d3d
-
SHA256
cdb348812f6840a8802a064ffd3203f7b29cb79548f6271c704ebfc7e2bbfa0e
-
SHA512
faf013eb4dfb128f24048b1254301bf7758824f8be64294cbffe67bcf327fa501c9a90f6d8b605afdbc2a2ce683a03ed8402b9e7c3196e429c4b77064265569f
-
SSDEEP
1536:nlg4dLhU2doqPpYkjchAk0pdogtKjcznpfuv8vuv5l:G4dLC2OgjcWkEOgtKjUnpuv8G
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
cdb348812f6840a8802a064ffd3203f7b29cb79548f6271c704ebfc7e2bbfa0e.dll windows x86
eedb241a7c4d8e6f263b209e135ead45
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
DeleteCriticalSe
InitializeCriticalSection
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
CreateEventA
TerminateThread
CloseHandle
ord15
ord23
ord52
ord9
ord16
ord21
ord116
ord115
ord3
ord18
ord19
ord12
ord11
ord6
ord57
ord10
ord151
ord17
ord20
ord13
ord1
ord5
ord4
ord2
Sections
.text Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ