gh0strat | 01232c37b90270c6fe49261c1193a10ab2f608488830f120aae9780feaf8131a

Sharing

Copy URL Twitter E-mail

General

Target

01232c37b90270c6fe49261c1193a10ab2f608488830f120aae9780feaf8131a
Size

157KB
MD5

8671e8ccdf777d996f654c778595a8fc
SHA1

98c0cceb279b3dad38fc581f80a3947fa0b02386
SHA256

01232c37b90270c6fe49261c1193a10ab2f608488830f120aae9780feaf8131a
SHA512

c5a8085c17b5e432369ed3ed2568d43532a111284311f73695beb686febd4bfbdb8c83b09535b0024d679df2844e543b3d41e881605bcbade08252d0baff8c9e
SSDEEP

3072:uc8PfzetnCU8oM4/nERFl9fQMHNE+nAW95/:0qnzhERFl9fhf

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

01232c37b90270c6fe49261c1193a10ab2f608488830f120aae9780feaf8131a
.exe windows x86

7153245d97e8ffbeed0496e49d3bc625

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateThread
DeleteFileA
lstrcatA
GetSystemDirectoryA
ExitProcess
SetFileAttributesA
GetModuleFileNameA
ReleaseMutex
OpenMutexA
lstrcmpiA
GlobalMemoryStatus
GetSystemInfo
OpenEventA
ResumeThread
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
GetEnvironmentVariableA
GetShortPathNameA
lstrcpyA
WriteFile
SizeofResource
CreateFileA
LoadResource
FindResourceA
lstrlenA
UnmapViewOfFile
FlushViewOfFile
DeviceIoControl
MapViewOfFile
CreateFileMappingA
GetFileSize
LocalFree
FormatMessageA
SetErrorMode
CreateMutexA
WinExec
SetUnhandledExceptionFilter
CopyFileA
GetCurrentThreadId
GetStartupInfoA
GetModuleHandleA
CreateProcessA
GetProcessHeap
HeapAlloc
GetCurrentProcessId
CreateThread
GetLocalTime
GetTickCount
Sleep
CancelIo
InterlockedExchange
SetEvent
FreeLibrary
ResetEvent
GetLastError
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
LoadLibraryA
GetProcAddress
FreeResource

user32

ExitWindowsEx
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
wsprintfA

advapi32

RegQueryValueExA
RegCreateKeyA
RegFlushKey
RegOpenKeyA
OpenSCManagerA
OpenServiceA
DeleteService
RegCreateKeyExA
RegSetValueExA
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegCloseKey
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
QueryServiceStatus
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
StartServiceA
CreateServiceA
AdjustTokenPrivileges

msvcrt

_exit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
__CxxFrameHandler
??2@YAPAXI@Z
_CxxThrowException
rand
sprintf
srand
time
strrchr
malloc
puts
realloc
localtime
atoi
exit
strncmp
_except_handler3
_beginthreadex
calloc
free
??1type_info@@UAE@XZ
_XcptFilter
_acmdln
__getmainargs
_initterm

ws2_32

setsockopt
htons
gethostbyname
WSAIoctl
select
recv
closesocket
send
inet_addr
connect
sendto
WSASocketA
htonl
getsockname
WSACleanup
WSAStartup
socket

Sections

.Buffer
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Socket
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.DDos
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Kernel
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Manager
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7153245d97e8ffbeed0496e49d3bc625

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

ws2_32

Sections

.Buffer Size: 1024B - Virtual size: 960B

.Socket Size: 2KB - Virtual size: 2KB

.text Size: 32KB - Virtual size: 31KB

.DDos Size: 10KB - Virtual size: 9KB

.Kernel Size: 1024B - Virtual size: 960B

.Manager Size: 512B - Virtual size: 128B

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 8KB - Virtual size: 10KB

.rsrc Size: 92KB - Virtual size: 92KB

.Buffer
Size: 1024B - Virtual size: 960B

.Socket
Size: 2KB - Virtual size: 2KB

.text
Size: 32KB - Virtual size: 31KB

.DDos
Size: 10KB - Virtual size: 9KB

.Kernel
Size: 1024B - Virtual size: 960B

.Manager
Size: 512B - Virtual size: 128B

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 8KB - Virtual size: 10KB

.rsrc
Size: 92KB - Virtual size: 92KB