Behavioral task
behavioral1
Sample
1f1083596cea3fbe350f471234f21b99.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
1f1083596cea3fbe350f471234f21b99.exe
Resource
win10v2004-20231020-en
General
-
Target
1f1083596cea3fbe350f471234f21b99.exe
-
Size
912KB
-
MD5
1f1083596cea3fbe350f471234f21b99
-
SHA1
c81c2d6f548f0147229ed489f1d5cc3ceba3d2a5
-
SHA256
f9a59ea2a09c0a780f9069f618521b6643eb4ec7fc77857b61cba67775719b1f
-
SHA512
c561880994c29bfbbc25060d597bf0dd775c4f8d99d2e27ebb2a1607f938869e0871381c0f9086a7536d5033ce447f1536ad14c8c42d11eadf3acd730c626e7c
-
SSDEEP
24576:ouLwoR5RNPjKoOAeh0PpS672TFU+CWYPMeXf1lqA:RPjOa172TarkCf1lH
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1f1083596cea3fbe350f471234f21b99.exe
Files
-
1f1083596cea3fbe350f471234f21b99.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.data Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nkh Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE