Behavioral task
behavioral1
Sample
5e7e4bda0c2f734515e35882259a0be7fabbf3345c05ff5ded19b7a006f87e1b.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
5e7e4bda0c2f734515e35882259a0be7fabbf3345c05ff5ded19b7a006f87e1b.exe
Resource
win10v2004-20230703-en
General
-
Target
5e7e4bda0c2f734515e35882259a0be7fabbf3345c05ff5ded19b7a006f87e1b
-
Size
3.3MB
-
MD5
1540dc6605509072bf67e60ab7a9c9c4
-
SHA1
9eae6de8d3f72faa919b3d1d3c2d67706d490cd0
-
SHA256
5e7e4bda0c2f734515e35882259a0be7fabbf3345c05ff5ded19b7a006f87e1b
-
SHA512
8cd5ed3344225150e83257a19342ec3839d21340f962b71d0e15fc1e4641358a584cc15e59ff00f63d546bf9a1c8da7246cc6005333467ac736505228241e0a3
-
SSDEEP
49152:mDrkT1xTVFBVP1aBfpVpN5Jq2jBdKdmNmt2SjT34fmJNZivEhnFrBmjQUUOPBWf+:Aovr9jWtafw
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5e7e4bda0c2f734515e35882259a0be7fabbf3345c05ff5ded19b7a006f87e1b
Files
-
5e7e4bda0c2f734515e35882259a0be7fabbf3345c05ff5ded19b7a006f87e1b.exe windows x86
e48cb6bc30b83dc75f9ed4fe05db5fcb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32 kernel32
WindowFromPoint TB�
Sections
.text Size: 2.8MB - Virtual size: 8.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
SE Size: 511KB - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
SE Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SE Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SE Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ