Behavioral task
behavioral1
Sample
1740efaa328af419e6834ffdc02184a0_exe32_JC.exe
Resource
win7-20230831-en
General
-
Target
1740efaa328af419e6834ffdc02184a0_exe32_JC.exe
-
Size
188KB
-
MD5
1740efaa328af419e6834ffdc02184a0
-
SHA1
58e5f5672cd669d58256dd83454580d17d3325a5
-
SHA256
434bc0b3e669789c604425db77904693f48c9a20a535295796d2a4f6285df71d
-
SHA512
987387ae0908d9b96fe6db497d9618399938efd4a1c23da757c304775c9c41e2b02dcf81e6a928e51a3be1a6d2aec5d73bc2ec0e09c95eb37cb0a7f09d5abbc5
-
SSDEEP
3072:GJuGnYhTbK80khR/OW1oWOQ1f9xHwm1PXBmXZFeA28pM6EdePl9dehiv80P80Cnn:GJueTkfOwoWOQ3dwaWB28edeP/deUv8M
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1740efaa328af419e6834ffdc02184a0_exe32_JC.exe
Files
-
1740efaa328af419e6834ffdc02184a0_exe32_JC.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.data Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nkh Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE