Behavioral task
behavioral1
Sample
a1d0d46e1e5988a06130719c8c6dd9514d406d1c7735913e78be0eb781edf9b1.exe
Resource
win7-20220812-en
General
-
Target
a1d0d46e1e5988a06130719c8c6dd9514d406d1c7735913e78be0eb781edf9b1
-
Size
80KB
-
MD5
16ba1b378db2ee4bb3b5800d7baf1449
-
SHA1
785ba2b274816cd036e8957524c3caf264c213ce
-
SHA256
a1d0d46e1e5988a06130719c8c6dd9514d406d1c7735913e78be0eb781edf9b1
-
SHA512
77ebb0eea0898410b866513a4c66e6e5ef6c9054a4c7b20eedc92e8440750cdbc818b43f38b36f44d37087afeeb01be048c5fa5fe2476ae8330560989f73dcd4
-
SSDEEP
1536:nOmPNrJc9PSf8tSjetUhL/0Y7cwRXX/kBypP1BA:OmPNrJiPk8tSwswYlXX/kByx1BA
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
a1d0d46e1e5988a06130719c8c6dd9514d406d1c7735913e78be0eb781edf9b1.exe windows x86
90eacfd320af1b4f9240418dd484f65a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
FreeResource
Sleep
WriteFile
CreateFileA
DeleteFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
WaitForSingleObject
CreateEventA
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
GetTickCount
GetModuleHandleA
GetLastError
RaiseException
InterlockedExchange
GetStartupInfoA
LocalAlloc
FreeLibrary
msvcrt
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_acmdln
exit
_exit
srand
rand
sprintf
putchar
_XcptFilter
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ľ������ Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
ľ������ Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ