Behavioral task
behavioral1
Sample
c81ae23243e11b7ff48369d5f623b55e8d45f4d3ce50a39765c33ba4a17ff687.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c81ae23243e11b7ff48369d5f623b55e8d45f4d3ce50a39765c33ba4a17ff687.exe
Resource
win10v2004-20220812-en
General
-
Target
c81ae23243e11b7ff48369d5f623b55e8d45f4d3ce50a39765c33ba4a17ff687
-
Size
304KB
-
MD5
ec3678a63f66cf87c795d4cbee86dc51
-
SHA1
58ddb8454ef10c3e10b593af2438b13955579cdc
-
SHA256
c81ae23243e11b7ff48369d5f623b55e8d45f4d3ce50a39765c33ba4a17ff687
-
SHA512
4a0015fe879490cc79d7b41291d53bc3ddc06fb9ead1a1f6e5ab97627aaa21ff7d50aba32bbe74e429668ccf9e5ef9a846b1d4d205ce14d65ceda9a824203d8b
-
SSDEEP
6144:4iTti+B0wL7tUJ5Vp34yYH4G7a4G7vWFkl:XPB0wdUrVNJKMvXl
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
c81ae23243e11b7ff48369d5f623b55e8d45f4d3ce50a39765c33ba4a17ff687.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ