Behavioral task
behavioral1
Sample
eee0b63271fc52236d05bc866831301b.exe
Resource
win7-20231215-en
General
-
Target
eee0b63271fc52236d05bc866831301b.exe
-
Size
348KB
-
MD5
eee0b63271fc52236d05bc866831301b
-
SHA1
20f8fa148c3722af27fecda38ed4eaf0eb9986cf
-
SHA256
31a80e961f018334a3e85c16e5e7b46522ae5041eafa9665044e257ef03e3b04
-
SHA512
8ed9b4640b8af562e3b6164194e63ad784f68f566a86f2e7f30f81af5ae613c8bb2e38f8c6d7ef0d5e82c76c2b2d4e2b3185d54cadbee19a76d21cb7ca4c2f67
-
SSDEEP
6144:MJueTkwOwoWOQ3dwaWB28edeP/deUv80P80Ap8UGwoTGHZOWJkqd0K4rG7eVT0SG:ouLwoZQGpnedeP/deUe1ppGjTGHZRT0y
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eee0b63271fc52236d05bc866831301b.exe
Files
-
eee0b63271fc52236d05bc866831301b.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.data Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nkh Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE