Behavioral task
behavioral1
Sample
NEAS.fcf26cf99dc86b2dfccd90d8b36cde00.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.fcf26cf99dc86b2dfccd90d8b36cde00.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.fcf26cf99dc86b2dfccd90d8b36cde00.exe
-
Size
114KB
-
MD5
fcf26cf99dc86b2dfccd90d8b36cde00
-
SHA1
c2a0227f866d2f71781e669ddad9ee4073e3eca1
-
SHA256
09944440b66a540e2377f2c081a479e9b03698326d70082f3ab19aa433c06eef
-
SHA512
44022cecba68c01f8db4c0d017f0530c06c2295dfa4d89d7a7d84020193b9ed48fc4332654cf229b34de29db0ea9e6168a7fad0dc8dc4f83cdfcf4ed28480934
-
SSDEEP
768:iJ9DqrcAbdGdi/SrVEoZe1eaE3zggwvl4/47ClfWg:in4cAb+i/SrMozgxE478H
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.fcf26cf99dc86b2dfccd90d8b36cde00.exe
Files
-
NEAS.fcf26cf99dc86b2dfccd90d8b36cde00.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 86KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ