Behavioral task
behavioral1
Sample
f5161c7a7c039a26dbe5f8c8169ebff2d03a03c224ff4c238c0e0bdd163ec202.exe
Resource
win7-20220812-en
General
-
Target
f5161c7a7c039a26dbe5f8c8169ebff2d03a03c224ff4c238c0e0bdd163ec202
-
Size
134KB
-
MD5
f2603da9a089e3511fdb94a867664ba4
-
SHA1
c6aa5c4fb170547e4a865f29789a8b558098704c
-
SHA256
f5161c7a7c039a26dbe5f8c8169ebff2d03a03c224ff4c238c0e0bdd163ec202
-
SHA512
796d4b82122361da7f4b5b63072a72dfddedbaf2cc21850a76882c29588c091900bd75df8efea7f87342b0bda5ac34b3f7377e0cf53f6fa945a6bb438d5b17c1
-
SSDEEP
3072:XHJop67/l26U8Fj+rW6MngUi0k0lKkozwkpgRwqMfNd:3gvH9UHrKkqwk6iqMf
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
f5161c7a7c039a26dbe5f8c8169ebff2d03a03c224ff4c238c0e0bdd163ec202.exe windows x86
2d45d747091e0ff1ed11f4845cb998e8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
lstrcmpiA
GetProcAddress
LoadLibraryA
FreeResource
Sleep
WriteFile
CreateFileA
DeleteFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
WaitForSingleObject
GetTickCount
CreateEventA
WinExec
GetWindowsDirectoryA
GetModuleHandleA
GetStartupInfoA
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
msvcrt
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
exit
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 516B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pmj Size: - Virtual size: 1B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE