Behavioral task
behavioral1
Sample
1597dd9a588b4cc679fd9ec89425f273.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1597dd9a588b4cc679fd9ec89425f273.exe
Resource
win10v2004-20231215-en
General
-
Target
1597dd9a588b4cc679fd9ec89425f273
-
Size
144KB
-
MD5
1597dd9a588b4cc679fd9ec89425f273
-
SHA1
10dd94da6c89297eb3668dcbae3471d662570e59
-
SHA256
6a46c1a37ee95c76aa3c1544c8b43e1a54cada1325d100e31b7c1084cb611327
-
SHA512
8c32423de7ff2a0886f41b7bf6cc10086f587c274f9b2c13f02716112c790e327ed09ec0801923bc34e82661732c2250cdf75786ddb82b2546d3c31eb3ea41c0
-
SSDEEP
3072:bFzM+c/b62UAuCWLM8a7Z144fqppBKAGGfdM:uACWLMFH4mUpBKAGGf
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1597dd9a588b4cc679fd9ec89425f273
Files
-
1597dd9a588b4cc679fd9ec89425f273.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 96KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ