Behavioral task
behavioral1
Sample
360e24b8c530821239bf751fb43b4cde.exe
Resource
win7-20231129-en
General
-
Target
360e24b8c530821239bf751fb43b4cde
-
Size
196KB
-
MD5
360e24b8c530821239bf751fb43b4cde
-
SHA1
76c5e7b061de6a8968f5ba2de6a97bb636330e59
-
SHA256
7bfc9dbf2eac45bda0976334d99f6355d0468817f3247b2e235ec11df7d62d5e
-
SHA512
e1981fa4e98a079e76a9e2aa099d294cfad72641fe99f2f9352741c4f5127596283a123cb5c078f00ed4e6e58d9ad2ea3fe830d6ff4f106c1d508d0cb6b22946
-
SSDEEP
6144:osIt6nW8QWBTyPRqyhYPbncTBlhHrtndnkv0:t9W8CJq8YPbncT30
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 360e24b8c530821239bf751fb43b4cde
Files
-
360e24b8c530821239bf751fb43b4cde.exe windows:0 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
CODE Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 166KB - Virtual size: 166KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata2 Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE