Behavioral task
behavioral1
Sample
120e1a06ad7b11100abd10ef0a2b9a78.exe
Resource
win7-20231215-en
General
-
Target
120e1a06ad7b11100abd10ef0a2b9a78
-
Size
286KB
-
MD5
120e1a06ad7b11100abd10ef0a2b9a78
-
SHA1
28de7bc2fad3d2b5a20ce360ae8ccd6af019762d
-
SHA256
ccb499813a7479dc9bb25fe864106159e3a88c6d040edeb347be926aef09dbf8
-
SHA512
de850b5e03306ffaabb61232f7c3d0d9548b863612678ba2d8dfd38e70acb6d627fecff9678fddede634fc9456c31b7d7ac5282b5fc5a2ae305ff8e1b161504f
-
SSDEEP
3072:eczE6bc7tqY9UKTnTBQur3cIEW+xUJAeyjJfuJp6rxMV:eeE6g7tN1T153VeSJ7CgD
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 120e1a06ad7b11100abd10ef0a2b9a78
Files
-
120e1a06ad7b11100abd10ef0a2b9a78.exe windows:4 windows x86 arch:x86
9333a639e91e699c17cc26d4676579b3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
lstrlenA
CreateDirectoryA
GetFileAttributesA
lstrcatA
GetWindowsDirectoryA
Sleep
ReleaseMutex
GetLastError
CreateMutexA
GetSystemDirectoryA
lstrcpyA
SetLastError
DeleteFileA
SetFileAttributesA
MoveFileA
GetTickCount
GetTempPathA
GetStartupInfoA
GetModuleHandleA
FindResourceA
LoadResource
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
CloseHandle
SizeofResource
WriteFile
FreeResource
WinExec
GetModuleFileNameA
CreateFileA
SetFilePointer
ReadFile
GetCurrentProcess
GetCommandLineA
user32
wsprintfA
advapi32
RegDeleteKeyA
RegQueryValueExA
CreateServiceA
OpenSCManagerA
OpenServiceA
StartServiceA
CloseServiceHandle
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegDeleteValueA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
msvcrt
realloc
malloc
strlen
_chkesp
_except_handler3
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
strcpy
strchr
strstr
__CxxFrameHandler
memcpy
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
__dllonexit
_onexit
_strnicmp
Sections
.text Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ