Behavioral task
behavioral1
Sample
e40ccb92d5b7648a161be86cb5d08dd2a6553bc1739ee2fac13f5608449334b8.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e40ccb92d5b7648a161be86cb5d08dd2a6553bc1739ee2fac13f5608449334b8.exe
Resource
win10v2004-20230703-en
General
-
Target
e40ccb92d5b7648a161be86cb5d08dd2a6553bc1739ee2fac13f5608449334b8
-
Size
8.3MB
-
MD5
e8a6e730db34eaa0cfafdb3ee92b3529
-
SHA1
067cf47edf315e522895b7fdbd241c43d97d36a4
-
SHA256
e40ccb92d5b7648a161be86cb5d08dd2a6553bc1739ee2fac13f5608449334b8
-
SHA512
69fca8f5c95a093857ae9b997e4592716ebf11634632e5bb9bcb5446b7714a56a203f4a4c3c7210375be7821395dad7d65aa158dd1385577c275287ca6f97a3e
-
SSDEEP
49152:sdrkT1x5VFBVP1aBfpVpN5Jq2jBdKdmNmt2SjT34fmJNZivEhnFrBmjQUUOPBWf3:4ov99jEB4LehNe
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e40ccb92d5b7648a161be86cb5d08dd2a6553bc1739ee2fac13f5608449334b8
Files
-
e40ccb92d5b7648a161be86cb5d08dd2a6553bc1739ee2fac13f5608449334b8.exe windows x86
4cb238a4d26cb0a79f174973ff0c8fc8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
gdi32 kernel32
SetBkMode SR�
Sections
.text Size: 7.9MB - Virtual size: 7.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
SE Size: 364KB - Virtual size: 364KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
SE Size: 17KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SE Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ