Behavioral task
behavioral1
Sample
ec15d087a6363c8c48fe3bbda8dad66c62825f89056cf217fd6c221bacd1e854.exe
Resource
win7-20220812-en
General
-
Target
ec15d087a6363c8c48fe3bbda8dad66c62825f89056cf217fd6c221bacd1e854
-
Size
313KB
-
MD5
5e3d9b2460ae5bee4e9b187e168defdb
-
SHA1
dfd7b27587523556bc530d252c1db85890e82568
-
SHA256
ec15d087a6363c8c48fe3bbda8dad66c62825f89056cf217fd6c221bacd1e854
-
SHA512
d689ac3b969cf1854e55184553e929eaadee1cef5c732e466f5c157b3ee974e98b330c8a916fe3331cfbfb2a81c6907bb9044f670ecd58a3f0a143ecaca137b9
-
SSDEEP
6144:SLWHahJJhALbUvwmLrgTbxfB1Mmg1Y8auL8PodPvQWqv:tiJYLbwH4x51Mm0Y8/wPIPIN
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
ec15d087a6363c8c48fe3bbda8dad66c62825f89056cf217fd6c221bacd1e854.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ