Behavioral task
behavioral1
Sample
952735ef74bc55f937b3ebb1ee19083c3ef90bd8d54a355f81e491fba7fb7bb6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
952735ef74bc55f937b3ebb1ee19083c3ef90bd8d54a355f81e491fba7fb7bb6.exe
Resource
win10v2004-20220812-en
General
-
Target
952735ef74bc55f937b3ebb1ee19083c3ef90bd8d54a355f81e491fba7fb7bb6
-
Size
180KB
-
MD5
af7138281cfb18fd35c6dcbad18f072b
-
SHA1
1513c4d01c16fd81b6b533372c88851717cf8e9d
-
SHA256
952735ef74bc55f937b3ebb1ee19083c3ef90bd8d54a355f81e491fba7fb7bb6
-
SHA512
c63b37b7404d6fe3a10fea89655f1a2ac2e3227592f1b2dfd939b62f3c7a637938d5c8932d4693a588c43c53e4647c9f9c55cb205921c993a3a5b4d526f25fc2
-
SSDEEP
3072:aRp7Z8wtdFHfdVeHh53lfnZN9uciBM7WpIBCVghTbaesyp:aRp7ioFHfdADHGc20WpwCVghTba4
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
952735ef74bc55f937b3ebb1ee19083c3ef90bd8d54a355f81e491fba7fb7bb6.exe windows x86
d56a5e78575b5d632698e542b2ac6218
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
MoveFileA
FreeResource
SizeofResource
SetFileTime
LocalFileTimeToFileTime
FindFirstFileA
lstrcatA
GetSystemDirectoryA
LoadResource
FindResourceA
GetTickCount
GetFileAttributesA
ResumeThread
CreateProcessA
SetLastError
GetCurrentThread
SetPriorityClass
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
SetUnhandledExceptionFilter
ReleaseMutex
CreateMutexA
GetCommandLineA
GetModuleHandleA
GetStringTypeA
LCMapStringW
LCMapStringA
lstrcmpiA
lstrlenA
lstrcpyA
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
CreateFileA
SetFilePointer
ReadFile
CloseHandle
GetLastError
GetProcessHeap
HeapFree
Sleep
ExitProcess
DeleteFileA
GetCurrentProcess
LoadLibraryA
SetThreadPriority
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
RtlUnwind
HeapReAlloc
HeapAlloc
RaiseException
GetStartupInfoA
GetVersion
VirtualFree
VirtualAlloc
IsBadWritePtr
GetVersionExA
HeapDestroy
HeapCreate
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
WriteFile
GetStringTypeW
user32
wsprintfA
advapi32
CreateServiceA
RegQueryValueExA
GetUserNameA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
StartServiceA
CloseServiceHandle
OpenSCManagerA
OpenServiceA
shell32
SHGetSpecialFolderPathA
netapi32
NetUserGetLocalGroups
NetApiBufferFree
Sections
.text Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ