Behavioral task
behavioral1
Sample
2449bdedf691972e43f4ea34bc6aa905be406196e73c82bf248738acadf4240e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2449bdedf691972e43f4ea34bc6aa905be406196e73c82bf248738acadf4240e.exe
Resource
win10v2004-20220901-en
General
-
Target
2449bdedf691972e43f4ea34bc6aa905be406196e73c82bf248738acadf4240e
-
Size
204KB
-
MD5
9232c3a331afee1078a218943b581c16
-
SHA1
169c4c5da07f7de97dac52b129bddd5608ff402b
-
SHA256
2449bdedf691972e43f4ea34bc6aa905be406196e73c82bf248738acadf4240e
-
SHA512
eafb00d41857bec881fb5d5549e67d0cedf93ba13edae90e29b0f0a165220a7a3e1b292913ae463a632ef254e7249b9db8af6c95e230b98d4678b0d96c4f643c
-
SSDEEP
3072:/a/aMtDSsNSgg8vflKFBtqTI8x4ycD7iZAJE8tTY3tOc:ia/sN5xvflHJxTk7iZAJE8tTgO
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
2449bdedf691972e43f4ea34bc6aa905be406196e73c82bf248738acadf4240e.exe windows x86
b3d176634a1ecc6e00aa2bc56281c8d8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
FreeLibrary
SizeofResource
LockResource
FindResourceA
CreateDirectoryA
GetTickCount
FreeResource
CloseHandle
WriteFile
MultiByteToWideChar
lstrlenA
CreateFileA
GetLocalTime
Sleep
ExitProcess
WinExec
CopyFileA
MoveFileExA
MoveFileA
GetModuleFileNameA
GetLastError
GetCurrentProcess
HeapFree
HeapAlloc
LocalAlloc
InterlockedExchange
RaiseException
GetFileAttributesA
HeapReAlloc
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
VirtualFree
VirtualAlloc
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetStdHandle
FlushFileBuffers
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
ReadFile
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 168KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ