Behavioral task
behavioral1
Sample
bc0399239d66c1a6a5a2bf155882a268.exe
Resource
win7-20240221-en
General
-
Target
bc0399239d66c1a6a5a2bf155882a268
-
Size
142KB
-
MD5
bc0399239d66c1a6a5a2bf155882a268
-
SHA1
6486d8bbf71506a7b7f0e58aa66744e5db387486
-
SHA256
4ae297a64a34ab7c7d9530f31afd5ec92f86ca79c71e0fa51c22e1aa7d9226db
-
SHA512
49651c2b6f439d324f782907f26b206ddee167afa77fbae62c7cd02bd3a8e46162d259ea23c21d1599356d3268321aa25b90c94a99ae429d6f49d301cb86a20e
-
SSDEEP
3072:MRn1vFHCqcDVvR7p0+8u9NMK+kl5wHrmXmqCxout:SDHRciu9NMrkbwHggoS
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bc0399239d66c1a6a5a2bf155882a268
Files
-
bc0399239d66c1a6a5a2bf155882a268.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
CODE Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 49KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE