gh0strat | 0d1bb9128c6e9b7d09b84ac618811ce4fa43e33b87c0f42e836e6887f195a7ce | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d1bb9128c6e9b7d09b84ac618811ce4fa43e33b87c0f42e836e6887f195a7ce
Size

790KB
MD5

18971a9ef97c8154f0487bcad54d1970
SHA1

87788488bac6670954d8fdafba8f5ce5ccf1c233
SHA256

0d1bb9128c6e9b7d09b84ac618811ce4fa43e33b87c0f42e836e6887f195a7ce
SHA512

a38581e6f0c0a6caac14ab67dcbd0c2fbb3636ece1c8710f8cb25253c798789711ad0fe4c4e0ffcf29dc56d542ce9b776c891795bb01ce2ed3e5a4a53f546942
SSDEEP

12288:hJI3L3+BTDQGxeJozwEEQYiMaCDm4jVp94d/Bi0z:vIb3+BTDQGxeJosEENDLh7Q/5

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

0d1bb9128c6e9b7d09b84ac618811ce4fa43e33b87c0f42e836e6887f195a7ce
.exe windows x86

c4a2407f5c26628324f031bb68c39a54

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
CreateFileA
ReadFile
SetFilePointer
CreateDirectoryA
WinExec
WideCharToMultiByte
SetFileAttributesW
CreateFileW
GetModuleFileNameW
ExpandEnvironmentStringsA
GetTickCount
GetModuleHandleA
GetStartupInfoA

msvcrt

sprintf
rand
??2@YAPAXI@Z
wcslen
srand
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
??3@YAXPAX@Z
strncpy

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ