Behavioral task
behavioral1
Sample
c6b6d5b95419df05f0bf3321920f74236b455aa1c4ee0cbd6c51785656109d48.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c6b6d5b95419df05f0bf3321920f74236b455aa1c4ee0cbd6c51785656109d48.exe
Resource
win10v2004-20221111-en
General
-
Target
c6b6d5b95419df05f0bf3321920f74236b455aa1c4ee0cbd6c51785656109d48
-
Size
131KB
-
MD5
a8eb54c5adc5c6a46cf259374755a579
-
SHA1
ed16f28c51975962aa5f5947ac7f20d57c135dd7
-
SHA256
c6b6d5b95419df05f0bf3321920f74236b455aa1c4ee0cbd6c51785656109d48
-
SHA512
65572021f3032001483861d6803d8cefa36f4a789da69a00eb6adbb80b8553fa67a919847d145de576929564a304f256e939cee98bb5745a5f30a4b83a62ee2e
-
SSDEEP
3072:lu+0qlgByBTEur7VsuRh/DBiE/8bNJFXIccx+tJdnJ0:lODyBTE0V1LDw5N3YccqJdnJ0
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
c6b6d5b95419df05f0bf3321920f74236b455aa1c4ee0cbd6c51785656109d48.exe windows x86
Code Sign
ce:b1:27:b2:94:62:69:e5:8c:4f:e0:e6:1d:cd:0b:1c:1c:bf:93:21Signer
Actual PE Digestce:b1:27:b2:94:62:69:e5:8c:4f:e0:e6:1d:cd:0b:1c:1c:bf:93:21Digest Algorithmsha1PE Digest MatchesfalseTrustedfalseSigning CertificateNO CERTIFICATEHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ