gh0strat | 4fb19c549f2bcdc37eed40ecf657b24c04f8cbf111d631442bcedda50947649a

Sharing

Copy URL Twitter E-mail

General

Target

4fb19c549f2bcdc37eed40ecf657b24c04f8cbf111d631442bcedda50947649a
Size

185KB
MD5

25691cae8011ebc68fd4b2def88ac56e
SHA1

4dbeb8d4cfe4e9f92ed1867f17e3ce56281dee5d
SHA256

4fb19c549f2bcdc37eed40ecf657b24c04f8cbf111d631442bcedda50947649a
SHA512

50fd528a86f0208375dbbfcfb3c151bc3c85ace7398916f55036b3433dc26a2db9ae91b6e3582168cec01378249c87e29c06d07c278b188e61120036f9be9b88
SSDEEP

3072:0jfqe2GF6y0twDoQBp4soFCsXuGjUmmjbENGAn4I+Pcs07IvD:KP9F6y3oQP4soFhXJj7eABn9icsQi

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

4fb19c549f2bcdc37eed40ecf657b24c04f8cbf111d631442bcedda50947649a
.exe windows x86

50fe3ce6a0b7c86a8eeb2fa2bb378d6d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetCurrentThreadId
CreateDirectoryA
GetLocalTime
SetPriorityClass
GetCurrentThread
SetThreadPriority
CreateProcessA
GetModuleFileNameA
OutputDebugStringA
GetWindowsDirectoryA
GetFileAttributesA
SetLastError
lstrcmpiA
lstrcpyA
GetTempPathA
GetProcAddress
GetTickCount
FindResourceA
CreateFileA
SizeofResource
lstrlenA
SetFilePointer
FreeResource
MoveFileA
GetCurrentProcess
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
lstrcatA
GetLastError
GetModuleHandleA
HeapFree
LoadLibraryA
SetStdHandle
GetOEMCP
GetACP
RtlUnwind
RaiseException
HeapReAlloc
HeapAlloc
GetStartupInfoA
GetCommandLineA
GetVersion
SetUnhandledExceptionFilter
VirtualFree
VirtualAlloc
IsBadWritePtr
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
WriteFile
IsBadReadPtr
IsBadCodePtr
GetCPInfo
FlushFileBuffers

user32

PostThreadMessageA
GetMessageA
wsprintfA
GetInputState

advapi32

OpenServiceA
StartServiceA
RegCreateKeyA
RegSaveKeyA
RegRestoreKeyA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetUserNameA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
EqualSid
AddAce
GetAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityA

netapi32

NetUserGetLocalGroups
NetApiBufferFree

Sections

.bss
Size: - Virtual size: 5KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

50fe3ce6a0b7c86a8eeb2fa2bb378d6d

Headers

File Characteristics

Imports

kernel32

user32

advapi32

netapi32

Sections

.bss Size: - Virtual size: 5KB

.data Size: 47KB - Virtual size: 46KB

.rsrc Size: 348KB - Virtual size: 347KB

.bss
Size: - Virtual size: 5KB

.data
Size: 47KB - Virtual size: 46KB

.rsrc
Size: 348KB - Virtual size: 347KB