Behavioral task
behavioral1
Sample
aba9f3896ef9bad7af4d5ca95d6979d6.exe
Resource
win7-20240221-en
General
-
Target
aba9f3896ef9bad7af4d5ca95d6979d6
-
Size
141KB
-
MD5
aba9f3896ef9bad7af4d5ca95d6979d6
-
SHA1
3a2600d7bed9ab7ff34afe33dc5a4bc61bcac442
-
SHA256
79f82bde333ff0727a6c40b03f7e372b0e132625083d9d5a9166023325c92a85
-
SHA512
6da38ae0b1daa8f87dd58379d3707e9995a85e61676a652094ee1d42981313df2e670745adab5836eb782642c0b28cfc638883c92d2b47a83be795fc61e07fb7
-
SSDEEP
3072:N9+/MKlrBOTI8h7UVuRh/DBiEQcaKPXcDsJZ9:Nv0OTI0UQLDw8aiXcQZ
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aba9f3896ef9bad7af4d5ca95d6979d6
Files
-
aba9f3896ef9bad7af4d5ca95d6979d6.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 122KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ