Behavioral task
behavioral1
Sample
50aa29c5996e819bb172c1f544486f8eb67f1903a8655bd2015e5fc8a7494dee.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
50aa29c5996e819bb172c1f544486f8eb67f1903a8655bd2015e5fc8a7494dee.exe
Resource
win10v2004-20231020-en
General
-
Target
50aa29c5996e819bb172c1f544486f8eb67f1903a8655bd2015e5fc8a7494dee
-
Size
112KB
-
MD5
f1690f1bc2b80d046ac8c52a5a8b2916
-
SHA1
5623b1359d21937ec399d9a3b8f31144c2cd4b3f
-
SHA256
50aa29c5996e819bb172c1f544486f8eb67f1903a8655bd2015e5fc8a7494dee
-
SHA512
0cb0dfe3b191ea12882bf500962ad95cf89a807a8d2413b7642f8cfbf240ae63aa5375199630807cbcb68490f42991490f0fdb15e9d2fc6cfcb666c015f11023
-
SSDEEP
3072:cF6F15h/zIn5S1aj+cU9C8DCg0w9aINej:zFjhLI5SG+Fj9aIA
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule sample acprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50aa29c5996e819bb172c1f544486f8eb67f1903a8655bd2015e5fc8a7494dee
Files
-
50aa29c5996e819bb172c1f544486f8eb67f1903a8655bd2015e5fc8a7494dee.exe windows:6 windows
Headers