Behavioral task
behavioral1
Sample
fe28cf50c41ea00e278801eefaf101e8.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fe28cf50c41ea00e278801eefaf101e8.dll
Resource
win10v2004-20231215-en
General
-
Target
fe28cf50c41ea00e278801eefaf101e8
-
Size
104KB
-
MD5
fe28cf50c41ea00e278801eefaf101e8
-
SHA1
dbd178c563839849bf115650936a667ef0ae676a
-
SHA256
84273c444004df30c9b4c648da2743fe493dcf01ba062c68e7882d954c281cd6
-
SHA512
dfb5bcb2651ed0601a52c6f27f7ad0c039be5850e06fec2df9e6acb7725f5fb8578c5ea2a4fb40830c0253f1b1f033192b01aed0ad2142184f661e172de84738
-
SSDEEP
1536:E0Bq3fthxo0IdSgb8Bb5165VuRci/rPfBiEQ72mw7uKPdcDs:VBOTI8h7UVuRh/DBiEQcaKPdcDs
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fe28cf50c41ea00e278801eefaf101e8
Files
-
fe28cf50c41ea00e278801eefaf101e8.dll windows:6 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
Size: 73KB - Virtual size: 43KB
Size: 128KB - Virtual size: 4B
���� Size: 89KB - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
Size: 120KB - Virtual size:
Size: - Virtual size:
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA