Behavioral task
behavioral1
Sample
6948e9ff6dadcfdbeee1e886fb8633d5d1b77bc1ae4aad0ef65f390f90a76a3d.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
6948e9ff6dadcfdbeee1e886fb8633d5d1b77bc1ae4aad0ef65f390f90a76a3d.exe
Resource
win10v2004-20230831-en
General
-
Target
6948e9ff6dadcfdbeee1e886fb8633d5d1b77bc1ae4aad0ef65f390f90a76a3d
-
Size
4.2MB
-
MD5
c1f00a0363976486e20b3dca8ac3dfbc
-
SHA1
99624a655ba843ca6b40aa9bf50801e2b2df1c23
-
SHA256
6948e9ff6dadcfdbeee1e886fb8633d5d1b77bc1ae4aad0ef65f390f90a76a3d
-
SHA512
ccef6e01268caa18138633621cec33590fe12107fa7e2f1c67e439b62af79c2ea56ae6a9bf9f6df29f5b1610b9180352e5352e390456782ce73f593d63982380
-
SSDEEP
49152:/4e2EB/0Zt5fzA50Z5CYZeYZeYZeYZeYZeYZeYZoYZeYZV0f7EQu9TI6GCL:0S/0Zt5re0Uf7E/Bh
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6948e9ff6dadcfdbeee1e886fb8633d5d1b77bc1ae4aad0ef65f390f90a76a3d
Files
-
6948e9ff6dadcfdbeee1e886fb8633d5d1b77bc1ae4aad0ef65f390f90a76a3d.exe windows x86
603d021ade81e02f4091cd2a922cb43a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi kernel32
PathStripToRootA �B
Sections
.text Size: 3.6MB - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dsw Size: 589KB - Virtual size: 592KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.dsw Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dsw Size: 23KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dsw Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ