Behavioral task
behavioral1
Sample
eb1d604b307c81e27176eb8287f97b56f5adb36863026d9d62cbd4c1323e6fb5.exe
Resource
win7-20230831-en
General
-
Target
eb1d604b307c81e27176eb8287f97b56f5adb36863026d9d62cbd4c1323e6fb5
-
Size
199KB
-
MD5
92d26b3bdeba0db07a42ce6aa8aa5f0c
-
SHA1
ac358a243d47dcda2d56f14ed12d59e77096367a
-
SHA256
eb1d604b307c81e27176eb8287f97b56f5adb36863026d9d62cbd4c1323e6fb5
-
SHA512
a7d354a09c3692376d79370675c894b2d9ce4d0fd9628aaa887ac8f2b45dd283462b3efd70e5935cc0a083a569b0a071ff30d041b919e299f0353b526cd0ef1a
-
SSDEEP
3072:hoIAQWQA2wtGnc+me4gwWf2VBEOQqFCaezYgek:hHAQw6ZQecETMCGs
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eb1d604b307c81e27176eb8287f97b56f5adb36863026d9d62cbd4c1323e6fb5
Files
-
eb1d604b307c81e27176eb8287f97b56f5adb36863026d9d62cbd4c1323e6fb5.exe windows:4 windows x86
a417ac21ed8c96cb685df9843be49d97
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
WriteFile
SetFilePointer
CreateFileA
FreeResource
CloseHandle
GetLocalTime
GetTickCount
FindResourceA
GetProcAddress
LoadLibraryA
GetStringTypeA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
MultiByteToWideChar
RtlUnwind
HeapFree
RaiseException
ExitProcess
TerminateProcess
GetCurrentProcess
HeapAlloc
GetLastError
FlushFileBuffers
GetStdHandle
WideCharToMultiByte
GetModuleFileNameA
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
SetStdHandle
ReadFile
GetStringTypeW
user32
wsprintfA
msvcrt
__dllonexit
_CIpow
??2@YAPAXI@Z
_onexit
Sections
.text Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sxdata Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 142KB - Virtual size: 142KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ