gh0strat | 5e87f55c266d094680ca7a77d93043bdc428cd8263feeae74cfb9913272d5b07 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5e87f55c266d094680ca7a77d93043bdc428cd8263feeae74cfb9913272d5b07
Size

160KB
MD5

62545441f3a63cddfbfacf60745326b0
SHA1

15bfb6b71b6af49ae956f16d3bc9d2afad6e367d
SHA256

5e87f55c266d094680ca7a77d93043bdc428cd8263feeae74cfb9913272d5b07
SHA512

9725e2333c300c914612c976336ccf0dd5c6bdd1d83dc04a5e64893977dccd58dc109cf634bd9b878fc792d32880a906726015106e03a0571dac9bafec08d0b8
SSDEEP

3072:VYrZRmbDFvHMZZhe+vFu+IzZ//ysNasa1AKLXRlqg4:VY9wnFvMZ++tyZ//kOYXRl

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

5e87f55c266d094680ca7a77d93043bdc428cd8263feeae74cfb9913272d5b07
.exe windows x86

064561d45c60e9a37c29d2fed633958c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegSetValueExA
RegOpenKeyA
RegCreateKeyExA
StartServiceA
ControlService
ChangeServiceConfigA
OpenServiceA
OpenSCManagerA

msvcrt

__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
srand
rand
sprintf
??2@YAPAXI@Z
strcpy
strcat
putchar
strlen
_adjust_fdiv

kernel32

GetStartupInfoA
GetModuleHandleA
GetTickCount
GetWindowsDirectoryA
CreateEventA
WaitForSingleObject
FindResourceA
LoadResource
LockResource
DeleteFileA
Sleep
FreeResource
LoadLibraryA
GetProcAddress
CreateFileA

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ