Behavioral task
behavioral1
Sample
0c0475d374eb7cf1101fa9adc1498a6c.exe
Resource
win7-20231215-en
General
-
Target
0c0475d374eb7cf1101fa9adc1498a6c.exe
-
Size
149KB
-
MD5
0c0475d374eb7cf1101fa9adc1498a6c
-
SHA1
1c3ab019d0af5daa639fccd4a241368915911180
-
SHA256
864c818b470808da7f0a7d8190ba9f986e2d1eaa945ff6e5fc047d2e5eb3d54a
-
SHA512
35eb9d4cfe244d68a0e12154af407102e80cc03ea8dff79aa967878420612820279809c422780e8eca3099046002da2d9f9f917985737f3a15f299219b981f5b
-
SSDEEP
3072:8hFS9oMIIIWBIh1Oh1M6oiim3oTogEDzUUJIxe:8h+oMII9BIh1rybo0jbJke
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0c0475d374eb7cf1101fa9adc1498a6c.exe
Files
-
0c0475d374eb7cf1101fa9adc1498a6c.exe.exe windows:4 windows x86 arch:x86
a9742ce4617a389f4870caebbb07a035
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
GetWindowsDirectoryA
LocalFileTimeT
SetFileTime
SizeofResource
WriteFile
lstrlenA
CloseHandle
FreeResource
ExitProcess
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ