s_665754_134235_3563345_1231245_910384_0193848_login
Behavioral task
behavioral1
Sample
b526b8d4f1e00e5c58ac42497cb1f549faa59da4a9b0438a41e0ccad57043291.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b526b8d4f1e00e5c58ac42497cb1f549faa59da4a9b0438a41e0ccad57043291.exe
Resource
win10v2004-20240426-en
General
-
Target
b526b8d4f1e00e5c58ac42497cb1f549faa59da4a9b0438a41e0ccad57043291
-
Size
968KB
-
MD5
f940788cbb5df1025d8d354148269707
-
SHA1
f9e2e54db9e7b8bc9b301d5a98bce184241ccb23
-
SHA256
b526b8d4f1e00e5c58ac42497cb1f549faa59da4a9b0438a41e0ccad57043291
-
SHA512
453ccc5839ea90a73c22b7e5075563b1e421aad95001f1d34e4895e7e6c012b42b956b98f4790987639b761279c824da1721e854742cc95c12c87a210becaf02
-
SSDEEP
24576:S+9zDs2YhqDEA8QfxCo6l4nCh8Z6bT8RLJv4v2V7q/9Sxi5kIocln:Sc4YDPMo6lhhPTKLZ2Ig5kID
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
Processes:
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource b526b8d4f1e00e5c58ac42497cb1f549faa59da4a9b0438a41e0ccad57043291
Files
-
b526b8d4f1e00e5c58ac42497cb1f549faa59da4a9b0438a41e0ccad57043291.exe windows:4 windows x86 arch:x86
92ebf9fc2ff4c6bd4f461499ca62583a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord5194
msvcrt
_acmdln
kernel32
GetModuleHandleA
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
user32
GetWindow
advapi32
RegDeleteKeyA
shell32
SHGetFolderPathW
Exports
Exports
Sections
.text Size: 176KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sedata Size: 776KB - Virtual size: 776KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ