Behavioral task
behavioral1
Sample
fa17de99f8b61d28b28bd11fdef2174d.exe
Resource
win7-20231129-en
General
-
Target
fa17de99f8b61d28b28bd11fdef2174d
-
Size
117KB
-
MD5
fa17de99f8b61d28b28bd11fdef2174d
-
SHA1
f20e8c87836120740cbadf15db3894d483c2c7d2
-
SHA256
dd797c587ce8c0c0a1839e9ee41672937aa293f684d3e6fee5caad4ee674d165
-
SHA512
cfa712c80ff1f0481f4f0c8247e2523e089461574a3e4a96f8138f447a7f7cad0b853476b63a8d8be0f5b214cce6eab3417fb0cc09edec1c69dae1b11145cf9d
-
SSDEEP
3072:/xowSyGdgt4gweDudIR+TzwCCxSoDEdaTANklTw+fZoHu1kk:/xxSyG44gweadIR+ntwOdQyqw+hoy
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fa17de99f8b61d28b28bd11fdef2174d
Files
-
fa17de99f8b61d28b28bd11fdef2174d.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 106KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE