Behavioral task
behavioral1
Sample
b298643542af566d4a74792e9c2a802b0558cdb94d1125472c000a127e25ac5f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b298643542af566d4a74792e9c2a802b0558cdb94d1125472c000a127e25ac5f.exe
Resource
win10v2004-20220901-en
General
-
Target
b298643542af566d4a74792e9c2a802b0558cdb94d1125472c000a127e25ac5f
-
Size
260KB
-
MD5
f99eaafbdff05dd952a3a5619427b674
-
SHA1
aa003107d55359351638b5015ed37f3ce2940b65
-
SHA256
b298643542af566d4a74792e9c2a802b0558cdb94d1125472c000a127e25ac5f
-
SHA512
69005beecb180a576452bb82c76b0177907b73ebd94dad5975da5ea7bda3bdaa16a71c7789cdf1396634b8505f6081254f2dc61982fd61cc6fe995ab89677e1b
-
SSDEEP
6144:B2Rnh5EsZm2EP7RNgQRRYnR1Y09inGogj1Y6:Beh5EsZYPdNn+R6090Ni26
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
b298643542af566d4a74792e9c2a802b0558cdb94d1125472c000a127e25ac5f.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 148KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 60KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ