Behavioral task
behavioral1
Sample
bc858bd1b43fe77aa043d8e450660ab6f14d3f234f1bfea6c40ac56e5e102695.exe
Resource
win7-20220812-en
General
-
Target
bc858bd1b43fe77aa043d8e450660ab6f14d3f234f1bfea6c40ac56e5e102695
-
Size
163KB
-
MD5
6b09a42ca9aceee55bd62869d0699bfd
-
SHA1
bed4163ec5d032e92a2c8f06975a4bb6561894d3
-
SHA256
bc858bd1b43fe77aa043d8e450660ab6f14d3f234f1bfea6c40ac56e5e102695
-
SHA512
1e410410bbd288fb33fea063501efaeea28c110883d7e4af4608d247e4329adff8b1ac667dc83281bcc2fc1a06f7eb64c5026211088668d637679124390c068c
-
SSDEEP
3072:2iufchoWpWXvICjTKsmW4eb+4BreLMnWD5AF7l9C:2ahfpW/I5N541P25Ak
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
bc858bd1b43fe77aa043d8e450660ab6f14d3f234f1bfea6c40ac56e5e102695.exe windows x86
fb84f72b13c01f3fa728835836df8ff9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
lstrcmpiA
CreateToolhelp32Snapshot
GetTempPathA
ReleaseMutex
CreateMutexA
GetCommandLineA
WinExec
CreateThread
LoadLibraryA
GetStartupInfoA
SetPriorityClass
GetCurrentThread
SetThreadPriority
CreateProcessA
ResumeThread
SetFilePointer
ReadFile
GetTickCount
FindFirstFileA
LocalFileTimeToFileTime
SetFileTime
lstrlenA
MoveFileA
GetVersion
lstrcatA
GetModuleHandleA
GetLastError
CloseHandle
WriteFile
CreateFileA
GetCurrentProcess
GetProcAddress
DeleteFileA
CopyFileA
MoveFileExA
GetWindowsDirectoryA
ExitProcess
Sleep
Process32Next
Process32First
OpenProcess
WaitForSingleObject
CreateRemoteThread
FreeLibrary
user32
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
BlockInput
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
PostThreadMessageA
GetInputState
ShowWindow
FindWindowA
PostMessageA
wsprintfA
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??2@YAPAXI@Z
isdigit
strtoul
strncmp
malloc
??3@YAXPAX@Z
strchr
_except_handler3
_strlwr
strstr
_strrev
advapi32
ControlService
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegCloseKey
OpenServiceA
OpenSCManagerA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
StartServiceA
UnlockServiceDatabase
ChangeServiceConfigA
LockServiceDatabase
shell32
ShellExecuteA
SHGetSpecialFolderPathA
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ