Behavioral task
behavioral1
Sample
651c83e073f4100c17a9d561e0e9c0d0e4d399278e45db7da3299d03aef51c51.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
651c83e073f4100c17a9d561e0e9c0d0e4d399278e45db7da3299d03aef51c51.exe
Resource
win10v2004-20220901-en
General
-
Target
651c83e073f4100c17a9d561e0e9c0d0e4d399278e45db7da3299d03aef51c51
-
Size
196KB
-
MD5
1395245c3b2640e86b601960cbe883e0
-
SHA1
69e8f5d990db0f5c4242e8fb8cfa70625358454d
-
SHA256
651c83e073f4100c17a9d561e0e9c0d0e4d399278e45db7da3299d03aef51c51
-
SHA512
9108e02ecad34b7f18553a65645fe411642112b5123f3b4e0b07a753dffef3bdfe979dbcc2eefc5811059a7d7eee1c010e5a2405a5f55d3b497ff2154bb4abc7
-
SSDEEP
768:UJK00cNlT3oz/MbMrhIOWEp04hLsTQcWNlJZvdiborVB72fLIkz:FIihrrcSiozQ
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
651c83e073f4100c17a9d561e0e9c0d0e4d399278e45db7da3299d03aef51c51.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 413B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 191KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ