Behavioral task
behavioral1
Sample
04ad6736e48260305bdde03e69a6a55b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
04ad6736e48260305bdde03e69a6a55b.exe
Resource
win10v2004-20231215-en
General
-
Target
04ad6736e48260305bdde03e69a6a55b
-
Size
122KB
-
MD5
04ad6736e48260305bdde03e69a6a55b
-
SHA1
af4949057749a07e874e3082e52c06b2c784d34f
-
SHA256
c1bb02e2a2ff94e6bc03015402f1457662bd5d9527f7cf2149ae24ebda3932fd
-
SHA512
f7efa24319fef170df0d261bceb17f706adfbe24b9152ef13910971f2241fde2c6f45fb03ee1b7963aa27a6c2707fa06a83440e8a999cbc39add73d22d58d7bd
-
SSDEEP
1536:vW+/z4EdK4qsWl0W4S7HKQhw7Hnm/KYOch6SfayeeDlLQcDBTx7J:O+L4R4RWlL4dQs9YOi6kaye+lLQc1Tx
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04ad6736e48260305bdde03e69a6a55b
Files
-
04ad6736e48260305bdde03e69a6a55b.exe windows:4 windows x86 arch:x86
8e14d101053da3943acd55e08fb5ebe0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetProcAddress
LoadLibraryA
ExitProcess
SetFileAttributesA
SizeofResource
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
LoadResource
FindResourceA
lstrcatA
GetTempPathA
GetFileAttributesA
lstrlenA
SetUnhandledExceptionFilter
RtlUnwind
GetStartupInfoW
GetVersion
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
GetCommandLineA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
GetModuleFileNameA
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
WideCharToMultiByte
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
HeapAlloc
VirtualAlloc
HeapReAlloc
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 97KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ