Behavioral task
behavioral1
Sample
c85b0fbdaa5512f899b16b227377acc3be7af180e645fe82774fdc6f2f67bc57.exe
Resource
win7-20221111-en
General
-
Target
c85b0fbdaa5512f899b16b227377acc3be7af180e645fe82774fdc6f2f67bc57
-
Size
1.1MB
-
MD5
71917868212a3aa64662b6bdcbbcca38
-
SHA1
64a63d519b267c30d0715dcc61df52106919f585
-
SHA256
c85b0fbdaa5512f899b16b227377acc3be7af180e645fe82774fdc6f2f67bc57
-
SHA512
bbb5393c30529cc327e752f4c3c107271f7b758c0b340dd2a25f30177fefaa826472800e352b332e8d66d17036bc847975a641501925c99ff5dd5cfac36546dd
-
SSDEEP
24576:UQV1wwR/Hr+TcfFCvOY5kzM5cL9aEnP57G1Ta:Z3wkVGU
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
c85b0fbdaa5512f899b16b227377acc3be7af180e645fe82774fdc6f2f67bc57.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.nsp0 Size: 948KB - Virtual size: 948KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp1 Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp2 Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE