Behavioral task
behavioral1
Sample
c0166ff2ebe976f0596349323f9cfb00a73760207c315ad5ab545e475ddf6d51.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c0166ff2ebe976f0596349323f9cfb00a73760207c315ad5ab545e475ddf6d51.dll
Resource
win10v2004-20221111-en
General
-
Target
c0166ff2ebe976f0596349323f9cfb00a73760207c315ad5ab545e475ddf6d51
-
Size
120KB
-
MD5
4b06ffa2ec38218f19810521f226f960
-
SHA1
8351587fa29cd690d849857bc22f5c01f0f8d6d4
-
SHA256
c0166ff2ebe976f0596349323f9cfb00a73760207c315ad5ab545e475ddf6d51
-
SHA512
13663d5811c999f9717dadf52c33121fde895c93de1caa346529c45d9f70c1acd1a49f00af7e8dd7af1b499f41f26df4204bb6501c3cdf49b0365c40f25cdad4
-
SSDEEP
768:Lpy7AXYS7xPPvSkgujtiA7EthDkrSV6svgTrIfRCNF:4oYWvSkgIIthDkr06Nr
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
c0166ff2ebe976f0596349323f9cfb00a73760207c315ad5ab545e475ddf6d51.dll windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.data Size: 113KB - Virtual size: 113KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 976B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ