Behavioral task
behavioral1
Sample
0d4741695d69dd730d3fdf10bd84d323.exe
Resource
win7-20231215-en
General
-
Target
0d4741695d69dd730d3fdf10bd84d323
-
Size
256KB
-
MD5
0d4741695d69dd730d3fdf10bd84d323
-
SHA1
156e4f5860e01e9a8111ab2a344e4b723a7f6535
-
SHA256
cdd4460765bea66a5107b3d51cca41f38e11db5a350ac6f5513f805a9fc70459
-
SHA512
7e70f1b87566b5a1934d846d26b9b69104fcfc89c36b4715ab62559b4996440453e32f21cf346074658e34d62148b4f1e868b025bf0c0503a6614a63137fae9f
-
SSDEEP
6144:02Rnh5EsIm2E47RNYQRsyXGY09inGogT:0eh5EsIY4dNPtR090Ny
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d4741695d69dd730d3fdf10bd84d323
Files
-
0d4741695d69dd730d3fdf10bd84d323.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 148KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 28KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE