Behavioral task
behavioral1
Sample
c0ddfd1341214be99ebb1a30a2dfcdbc80c16dcbb8c12b60830ed341f9ec6f78.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c0ddfd1341214be99ebb1a30a2dfcdbc80c16dcbb8c12b60830ed341f9ec6f78.exe
Resource
win10v2004-20240226-en
General
-
Target
c0ddfd1341214be99ebb1a30a2dfcdbc80c16dcbb8c12b60830ed341f9ec6f78
-
Size
348KB
-
MD5
c809560811327edd46463546f4e8da2c
-
SHA1
9e51ea796ead02623f57475c9f9ab4ac71eb2038
-
SHA256
c0ddfd1341214be99ebb1a30a2dfcdbc80c16dcbb8c12b60830ed341f9ec6f78
-
SHA512
37cdde33e0da3d69d7191c62f2104ec49d10f0a32e84b47e8fb4668efd914e4fb8e763727ccbb578583c4c7caf2e58be99edb7f3c95bb4dfdf6b3866bdc552cf
-
SSDEEP
6144:MJueTkwOwoWOQ3dwaWB28edeP/deUv80P80Ap8UGwoTGHZOWJkqd0K4rG7eVT0Sj:ouLwoZQGpnedeP/deUe1ppGjTGHZRT0X
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c0ddfd1341214be99ebb1a30a2dfcdbc80c16dcbb8c12b60830ed341f9ec6f78
Files
-
c0ddfd1341214be99ebb1a30a2dfcdbc80c16dcbb8c12b60830ed341f9ec6f78.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.data Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.nkh Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE