Behavioral task
behavioral1
Sample
037fff8375552952fa679922ddcc4cc6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
037fff8375552952fa679922ddcc4cc6.exe
Resource
win10v2004-20231215-en
General
-
Target
037fff8375552952fa679922ddcc4cc6
-
Size
284KB
-
MD5
037fff8375552952fa679922ddcc4cc6
-
SHA1
20178c0c4d7b8337b073b0b7e755dfb24583fe4d
-
SHA256
637bb76e87f8790e019445dce51cee83fdb96389628413d82ad9dcdd795f9d4d
-
SHA512
3228fee3681d7d3d6e64600afa14ac595f62ff2902562abebf4c7c113286656c9593a67f10c4f26e6781ac6534fc9b8b033b0daf7587082ea5ca92460030f6b0
-
SSDEEP
6144:UH7m+RGK4y0ckBzTMklNixKZ5F9U3QyORGg9ynIUMoa6IH56dkWgyY:UH7m+RMyYRtZ5FCgyO0ggnIUMoMH5Vd1
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 037fff8375552952fa679922ddcc4cc6
Files
-
037fff8375552952fa679922ddcc4cc6.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.DsNiu Size: 280KB - Virtual size: 280KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE