Behavioral task
behavioral1
Sample
da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe
Resource
win10v2004-20221111-en
General
-
Target
da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668
-
Size
131KB
-
MD5
98d61cfcb810ea3ffbc6f21ce14fabea
-
SHA1
bc6423a5a21a7664dfa825d3df52ddff087de8c8
-
SHA256
da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668
-
SHA512
bc82c0a8b792c66ca240c438c627740bd7e3a9751ae57db43faaf7879039819e62f787292e3ed2f1da6fb3383ae348dfdf808582c6fa5423f60ce1585ed422ec
-
SSDEEP
3072:gu+2qlgByBTEur7VsuRh/DBiE/8bNJFX6ccx+tJdnJ0:gADyBTE0V1LDw5N3qccqJdnJ0
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
da133e995e3f8b6d4b4b0fa8b57a1cb1e6180ecfd9618064f46f53167126d668.exe windows x86
Code Sign
ae:e1:7f:3d:4c:16:15:bb:f4:a3:2b:f1:fe:25:e8:12:e8:ea:67:12Signer
Actual PE Digestae:e1:7f:3d:4c:16:15:bb:f4:a3:2b:f1:fe:25:e8:12:e8:ea:67:12Digest Algorithmsha1PE Digest MatchesfalseTrustedfalseSigning CertificateNO CERTIFICATEHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ