Behavioral task
behavioral1
Sample
07d3a78cf266573b3260c027b434bfb8.exe
Resource
win7-20231215-en
General
-
Target
07d3a78cf266573b3260c027b434bfb8
-
Size
336KB
-
MD5
07d3a78cf266573b3260c027b434bfb8
-
SHA1
795ada2e76aeb2b66602ca46a1c5168b09f10a05
-
SHA256
1c05b101b1cbd09ac62a624c0d015c3c01fe3cb3a45f401ef868423374da1b0d
-
SHA512
318fe2b37ed41cfb797aac25ec3bcda709242ca84f5e87792d27f7eac4912c74d4427df4b16fed0402c4897293aa35907791ca1d82178b394e774c17b527b845
-
SSDEEP
6144:uybDMGJyE51ZuwdBmefqEuQCrzjXB9qDWbIloeqos:tbBX5X0+RpCrzjXrqyut
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 07d3a78cf266573b3260c027b434bfb8
Files
-
07d3a78cf266573b3260c027b434bfb8.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.nsp0 Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp1 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nsp2 Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE