aE�P~r�&��vY8A�f�����{L\+�H���q�5��<����ި���hu��@��g.F> S�C���0*W}������;ɋ��oPfcW%�͡˒;���F�xu 4�f�z����Fi,U��J����>�|��7BK��w�� �� ��}���00���)uF�ش��qSV�_�2����M3�Bj~6̶�{JW�5����<��@�|Č.��1�d�,52��1���5]]M���̘r�da����Pi��7zL�Å�#�j�ՙK�i2�8A*'����;�L��$qμesOq6�}��̼|��:�H��E3�{�|�Zc���x���rSj�I��ˣ��P� ������Q���yժ�ܛ}����ƪtө>*��6g+�8�r5� D��0�I>|H���נKE��a�?���k��|O����{����}�=-^���y=���s�N]'��� �����j� ��_Wĉ���xE�~e&���ˬ���.���jN���Ӹ�1D�/Fӧ6�c�;o.Ч-�B�dhav��d�\�#�{�n�dSs�bl�:*k^�N��g&H-|:�Ղ���̉]��[ЛA@0r��@������ۚXh�T�S��@>"+H�����2x�Q����2�d��u�$�<�2w�����cܻdh��j�ʗx���֘���=Bw����Ǫo��D�rO%�<UL�=��p��>��,�|��E���C�4�T&��r"6a��F���X��V��&�RJ���� ���[�s��I|2aR��Tm��D-Td�KV���^5���o��<g��}�ܼ�� 7�H�����;$� ��4e.�0�b=��,�J���*K��� ~�a�c!��:[t�=���R�z�+#���+�����`���Kof+��%�1�ە�L��f#���2D αD�T"Q� ��S��ʡ��/yK� ݅y���^ߛl�����j�F������� G" �jnB�t��tl'�Q�������y`���;Ä���6��_T���Si��������������ɑ5ţ�ʖ����7���t7��@����<D� �Cp����^L�"/wE��v����xx�E7)M*Mb��;5��~�%Q�E`��OC���h�v�tq�� ��A>� 1-ٱNy�W�,:v������R t��goN�t�����H��r)UW6�5�T�v)�]wcr|��I+�L��@���m���Fr��xb+����-��M9a��1��/#]|p�4��T�Z�����G|�l.��ZΡ�aB��/t��"����I�O����01_7���wW���_,��*�Y�����gz���B�+<,yt������ܫ ���Rvoht�3M�p'㛑;�U_�&��Α�K��*9V�=(�O�K!�H��jO�~�Z�A��aL:`���IX����k9t����Zx��-sL���L��t��u�Jѳ=�U٘��(���~�z7��j#�,h�vq�8(��>@-��ۑ%��y�P:�g��K�Blc��� \'�VPE6�`��U"����ǝ1<v�Eq�r�Yc��)�!��{!I��31�WcT�M�2|'�uu�Z�_���E���㏝D���t��G?i/��_U�#�NP�I�������Ij[�7��A*��u��;4�!��e��E���s�M��c�:n�2��e@�(Ƿ�DJ��u�]P�}��-�H���k�'u&Åi�5L��-<_m�s���y&���� J�����V�GC��t��U�C��ak�E�x����1%��7�)�#�"�6e]@?�~��f��h�����G!I�f!)�D�<&�.B]i`����-�5�Yؖ�@�}�9�,0*���ow��:�����<���π �����?qg��{���M+?m�BdQOƸ���f��VV7�|��#���k�^��lUX�a�*�Mҕ�f����9װ]����7����ECU(��2�9g��qy3Z���4T��V��E�dg���j�V-����F]�� ��}�Q�5�ˍ���H&��N���#��x�2���`���R�()��7�+Y�^��ݏ rnlX�e�)����X��]'I�37��f8����ڝ�ʗT@+[�ؙ�~�Z�k��ܯcm.����Y�)��3��Z�`�dp)IF-����O�g�����L��������煔�����}CJ�M��%w�M�C�B���ӵ��י��7�zJP��+}`������>�DA�ۖ��«dQ��=�[|�O���qUӥQ���"]䓘���^����r�����g7�7U�4�#8�3��*�V�L憣G�w[�%�(���dH��'�7SE������U��j:Q[��m���sBo6F̺��W�B�5X�CTC'"D�����%p��,R��R!*���p�k3(��ؒ��!!�U~��݉G�K�*��/�i!n4�kl�G�������F� �sEҵh�2��d�gM���7.]��ڲg� lw����8: +�3�E���"����`ꜳH΄Xso�C/���mcA@����[0/�5����N,�U�T/�+@�����s�E�S�mƜ�ڵ���o�\��E�\}�}Ɗ��\w���m����@x.3('�q����J�W�В��S��M����t�f|��̠an���E�5���4Vx#����8�)�j+�R��<�|���$npE5h+ʫ��W�+^֯�w*�iN���YO���\�� ��+tZ$���(Ͱ2�%`�>����Bl>[�}�=B��r����?| � >�d-=���ue��A��ڔWT3�~f��v��D7����1Z��|�y[� �fI 0*Z�� ���0�$��s��o�M�(S��u�FL������:]�I��V��}XM�yѹ��vX� `3������uۑ��0^��_�9�d���zl&�B�X����^��aL�͕����L����G� j���خphs^mG���5�c�U��}S�� ��O�>�]�S�{Y��C<�i��WA��i�$/�e5jɺ?�pd8�f�d;��*6.+����"k7�<�_��
Behavioral task
behavioral1
Sample
NEAS.3eac91c32d2e2d0cf7d56bd2dd31bcf0.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.3eac91c32d2e2d0cf7d56bd2dd31bcf0.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.3eac91c32d2e2d0cf7d56bd2dd31bcf0.exe
-
Size
2.3MB
-
MD5
3eac91c32d2e2d0cf7d56bd2dd31bcf0
-
SHA1
bc787fcc7151adfb1ae0440e866e8d5c099de631
-
SHA256
cb547c0c1b7b9e304f4dc3aea80ffc9f88e2c33ea1a9de135147d6e20a6b2323
-
SHA512
7b521910442b687df205d4464131d5ca440a6b2b6ad0e0bd148e9012a85505b143c53d2292ad9e681eb8e8f5caaa11cd4eaba26182041acc572c6481ce4b8479
-
SSDEEP
49152:17ELLgs2T/BrxKSR0IZLGFtHWVcErsDjJ4cmxF0A3svD/DX+y4onCYDoD5:dELLl2zPGLDjJk0YsvD/D+donCYUV
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.3eac91c32d2e2d0cf7d56bd2dd31bcf0.exe
Files
-
NEAS.3eac91c32d2e2d0cf7d56bd2dd31bcf0.exe.exe windows:4 windows x86
087cbb5847e00281bb67ba782170214b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteExW
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
VirtualAlloc
VirtualFree
GetModuleFileNameA
ExitProcess
user32
UnregisterClassA
gdi32
SetTextColor
advapi32
RegOpenKeyExA
ole32
CoTaskMemFree
oleaut32
VarUI4FromStr
comctl32
InitCommonControlsEx
Exports
Exports
Sections
.text Size: - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX0 Size: 268KB - Virtual size: 265KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: - Virtual size: 142KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX2 Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 268KB - Virtual size: 265KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ