Behavioral task
behavioral1
Sample
50d9129e8bfd923b2a097bfd1d32d957.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
50d9129e8bfd923b2a097bfd1d32d957.exe
Resource
win10v2004-20231215-en
General
-
Target
50d9129e8bfd923b2a097bfd1d32d957
-
Size
132KB
-
MD5
50d9129e8bfd923b2a097bfd1d32d957
-
SHA1
bff83bd43b41a390f053a807deaa103fd6ae27f7
-
SHA256
bb71733be20ec776722b8fe8b13aca657d31f216a89546eb0094b35af0b57cf5
-
SHA512
b99a23a0f36d2943f3cf23f21448e6552a53e4360370c1a56c25109209dd92944bd36eeedf930ff03f7dda133f7e18ddd2836575ebcdfe7329f36dffcfc107a5
-
SSDEEP
3072:N5IzIulsAsobgQKyJ//xhDcs2S37E7ehd7XAG1:YIvN8txNt7Eez7XA
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 50d9129e8bfd923b2a097bfd1d32d957
Files
-
50d9129e8bfd923b2a097bfd1d32d957.exe windows:4 windows x86 arch:x86
e7ce753c125031172e118c93e3fe69a1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4129
ord858
ord540
ord1140
ord860
ord941
ord3811
ord3337
ord2820
ord815
ord561
ord800
msvcrt
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
__p__fmode
_XcptFilter
_exit
_onexit
__dllonexit
__CxxFrameHandler
_mbscmp
__set_app_type
_except_handler3
exit
_controlfp
kernel32
CloseHandle
FreeLibrary
GetSystemDirectoryA
WriteFile
lstrcatA
MoveFileExA
WinExec
Sleep
CreateFileA
SizeofResource
LockResource
GetTempPathA
WritePrivateProfileStringA
GetShortPathNameA
GetEnvironmentVariableA
lstrcpyA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
CreateProcessA
ResumeThread
GetModuleFileNameA
LoadLibraryA
FindResourceA
LoadResource
advapi32
StartServiceA
OpenServiceA
OpenSCManagerA
CloseServiceHandle
msvcp60
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
Sections
.text Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ