Main
Behavioral task
behavioral1
Sample
e43838d2f7cffde86108b792e14697e062d4d15f4ca4afaa89ff96f11b12f621.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
e43838d2f7cffde86108b792e14697e062d4d15f4ca4afaa89ff96f11b12f621.dll
Resource
win10v2004-20240412-en
General
-
Target
e43838d2f7cffde86108b792e14697e062d4d15f4ca4afaa89ff96f11b12f621
-
Size
88KB
-
MD5
4ed2d36992bd1b13b6365b6300b2d685
-
SHA1
e08e07c63c32abb63d1e44f9e996a1089b6fb937
-
SHA256
e43838d2f7cffde86108b792e14697e062d4d15f4ca4afaa89ff96f11b12f621
-
SHA512
6cade0e19b62464d9a33fd37a0367ccd1d05ea119b67dfd7cf6bc851e7dac67dc974141d6f8f146af287e26e5c66348de48d47d527afb5b06675a236409c1753
-
SSDEEP
1536:AjUi4h6vmDpjmEu2rF0PthcQzAfi5cyZouK:KX4hJ5nrm1hLzai5cyZ
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e43838d2f7cffde86108b792e14697e062d4d15f4ca4afaa89ff96f11b12f621
Files
-
e43838d2f7cffde86108b792e14697e062d4d15f4ca4afaa89ff96f11b12f621.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
.text Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ