Behavioral task
behavioral1
Sample
976e6be44c703bb993b5e27f383dee347b41c6584dff20e4d015206ab8cf931a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
976e6be44c703bb993b5e27f383dee347b41c6584dff20e4d015206ab8cf931a.exe
Resource
win10v2004-20220812-en
General
-
Target
976e6be44c703bb993b5e27f383dee347b41c6584dff20e4d015206ab8cf931a
-
Size
556KB
-
MD5
78b1dff7956e28064d337a86df100a68
-
SHA1
5e5ffd4c4b8206c5ad144fb09d9fb8c0912d440d
-
SHA256
976e6be44c703bb993b5e27f383dee347b41c6584dff20e4d015206ab8cf931a
-
SHA512
a3486ff517df060ae57e9ed31fdc77acdb6e6842f2a55362ba3495a9d26f4e0e97f94bb74a0655f670bb07d71272690d3f16f55210ba0e137ed9bc945ca652c1
-
SSDEEP
12288:djBtCduBqmqt1Qv9Ripphq0VIeXjCSWrR1lqMSTW:/tCd2qmhv9RipphQSCZrHEI
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
976e6be44c703bb993b5e27f383dee347b41c6584dff20e4d015206ab8cf931a.exe windows x86
5147b69a1b7fcde1e7bcf36da71618a1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord593
ord594
ord631
ord709
ord525
DllFunctionCall
ord600
__vbaExceptHandler
ord531
ord717
ProcCallEngine
ord537
ord645
ord648
ord572
ord681
ord100
ord616
ord618
Sections
.text Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 544KB - Virtual size: 540KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ