Behavioral task
behavioral1
Sample
NEAS.5b9227770c943413405ea54c16954940.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.5b9227770c943413405ea54c16954940.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.5b9227770c943413405ea54c16954940.exe
-
Size
304KB
-
MD5
5b9227770c943413405ea54c16954940
-
SHA1
84e2661f4e4c94ddcef6f67325c9bfd3722946e9
-
SHA256
69f8c0ce446c16ea7a4d153f806f6147ee31ef20236cc5144e2c89176cd5e467
-
SHA512
3bd753e10b9f536246836f0b275f01228bfa58669e3b8497dd29937798e2b485637244dcd575f028fc88a6ced2c8e731edf0de1dbd5e0bd9c716c044e57724ab
-
SSDEEP
6144:eiTtiWB0sL7tSJ5pp34O5/4G7v4G7AWFN:FXB0sdSrpNtzJAy
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.5b9227770c943413405ea54c16954940.exe
Files
-
NEAS.5b9227770c943413405ea54c16954940.exe.exe windows:4 windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 116KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ