Behavioral task
behavioral1
Sample
1473bed8d4d1cdc60c9b2a4f1e464d4b.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1473bed8d4d1cdc60c9b2a4f1e464d4b.exe
Resource
win10v2004-20231215-en
General
-
Target
1473bed8d4d1cdc60c9b2a4f1e464d4b.exe
-
Size
170KB
-
MD5
1473bed8d4d1cdc60c9b2a4f1e464d4b
-
SHA1
94ef844af29b953dd6eb081b1538e750c7534040
-
SHA256
8174fdcc197f48e98aedf90049c24c0f866cd9ed54d40df029451139454301f9
-
SHA512
a2d79e87013280b1dc76cfa7643523233ad7a526e3ebcdde60958b2ea1234ee2b4fcc517452c47c8ea12164aa72b97fcc59dd5d0d588c88d916f4dc520e15c47
-
SSDEEP
3072:jSK9ZhLtiyJ1qVOyQsxtlGPqlOvwjB//F71ZzJ9Y8HXqetIpVk4wo9:d9btik1JyQsMP9vwjlBLJmAXqetIpa4t
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1473bed8d4d1cdc60c9b2a4f1e464d4b.exe
Files
-
1473bed8d4d1cdc60c9b2a4f1e464d4b.exe.exe windows:4 windows x86 arch:x86
c675292951c1232b3b656156222b5766
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapFree
GetProcAddress
GetModuleHandleA
HeapAlloc
GetProcessHeap
GetLastError
lstrcatA
CloseHandle
DeviceIoControl
CreateFileA
GetVersionExA
GetModuleFileNameA
ExitProcess
DeleteFileA
SetFileAttributesA
MoveFileA
FreeResource
lstrlenA
WriteFile
SizeofResource
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
LoadResource
FindResourceA
GetTickCount
GetTempPathA
FreeLibrary
LoadLibraryA
ReadFile
SetFilePointer
lstrcpyA
SetLastError
GetFileAttributesA
lstrcmpA
Sleep
GetWindowsDirectoryA
WideCharToMultiByte
MultiByteToWideChar
SetUnhandledExceptionFilter
ReleaseMutex
WinExec
CreateMutexA
GetCommandLineA
GetCurrentThreadId
LocalAlloc
InterlockedExchange
RaiseException
RtlUnwind
HeapReAlloc
GetStartupInfoA
GetVersion
VirtualFree
VirtualAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentVariableA
HeapDestroy
HeapCreate
TlsSetValue
TlsAlloc
TlsGetValue
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ