Behavioral task
behavioral1
Sample
3e3cac56cb27cd0fd3f09657a1e9781590bab02af0e9ebc0a04769865d8e3d07.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3e3cac56cb27cd0fd3f09657a1e9781590bab02af0e9ebc0a04769865d8e3d07.exe
Resource
win10v2004-20240508-en
General
-
Target
3e3cac56cb27cd0fd3f09657a1e9781590bab02af0e9ebc0a04769865d8e3d07
-
Size
1.6MB
-
MD5
8866c8b5bc247dbbdf2964dd8e5d206a
-
SHA1
c08de54066cc37783feb4e0c66f98fef6b82d853
-
SHA256
3e3cac56cb27cd0fd3f09657a1e9781590bab02af0e9ebc0a04769865d8e3d07
-
SHA512
a38b73e57361c0b245a4d6468ddae17bf30a8f3718e9a63b72c267594db76ec26fad3d183c0dc15998e542665c41f27d1bb8fd7af5381f63029bf8525a14d0c4
-
SSDEEP
49152:YXVDSKkm50Xxgm0GgpDvEaNbS+rgknHWUaD7e:Yjd50XxgFGgpDvEiUkHWt6
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e3cac56cb27cd0fd3f09657a1e9781590bab02af0e9ebc0a04769865d8e3d07
Files
-
3e3cac56cb27cd0fd3f09657a1e9781590bab02af0e9ebc0a04769865d8e3d07.exe windows:4 windows x86 arch:x86
2d4f28a911adab9e1e84923b6227161a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlUnwind
user32
GetSysColorBrush
gdi32
SaveDC
comdlg32
GetFileTitleA
winspool.drv
OpenPrinterA
advapi32
RegCloseKey
shell32
DragQueryFileA
comctl32
ord17
oledlg
ord8
ole32
CLSIDFromString
olepro32
ord253
oleaut32
SysFreeString
wsock32
WSAStartup
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 724KB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sedata Size: 936KB - Virtual size: 936KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ