Behavioral task
behavioral1
Sample
8c6bf2516eeb2b54a5a53dc7c19ec128bf4b90e9312c4439555d491ce12e969e.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8c6bf2516eeb2b54a5a53dc7c19ec128bf4b90e9312c4439555d491ce12e969e.dll
Resource
win10v2004-20220812-en
General
-
Target
8c6bf2516eeb2b54a5a53dc7c19ec128bf4b90e9312c4439555d491ce12e969e
-
Size
120KB
-
MD5
2c84001a1ae2f29ba959da454470a460
-
SHA1
0fe47e62023ef3fa0f2591e46dd41aac89accf53
-
SHA256
8c6bf2516eeb2b54a5a53dc7c19ec128bf4b90e9312c4439555d491ce12e969e
-
SHA512
2d31821bd23d95c7f8398e46f98a6767c7eec833d0c8baa26559fb3db1ce51f6144ac8b5c37a493ffd732d5093fc058140e4d24c0d5113c26c9037610ea56681
-
SSDEEP
768:Lpy7AXYS7xPPvSkgujtiA7EthDkrSV6svgTrIfRCNFLPhncVAA40u3oP:4oYWvSkgIIthDkr06NrBPC43o
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
8c6bf2516eeb2b54a5a53dc7c19ec128bf4b90e9312c4439555d491ce12e969e.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.data Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 976B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ