Behavioral task
behavioral1
Sample
c121bb085b1cf56d403a8375e0f07af7d259c837921de20f949c3b2e26b526a3.exe
Resource
win7-20220812-en
General
-
Target
c121bb085b1cf56d403a8375e0f07af7d259c837921de20f949c3b2e26b526a3
-
Size
634KB
-
MD5
fc8ad3856757459a7102695b501469ad
-
SHA1
4910a844108045ae82e6e1c9ba9f687d7f8d5d75
-
SHA256
c121bb085b1cf56d403a8375e0f07af7d259c837921de20f949c3b2e26b526a3
-
SHA512
2d8bdfb19d715e39fc858ba08f19e4057b621072212b3be70a7c5c479dc911fefb8bfc8a710b8c8b1644a2551cb80e01c3bb77d08db8a759ad5e82d94946b4e7
-
SSDEEP
12288:qcjrLQhTeGDF1r+TStBXvWyZ4uVNedGlH5M5FLFPMdjnS:qcjeTeGDF1r+TStBXhZPVNXJ5M5FJkd
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
c121bb085b1cf56d403a8375e0f07af7d259c837921de20f949c3b2e26b526a3.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 487KB - Virtual size: 486KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 34KB - Virtual size: 502KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 112KB - Virtual size: 112KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE