gh0strat | e2ffa9f5fe4c38aa57eccdaaf42bae05b750c0153828b09dab5891a6520ecad8

General

Target

e2ffa9f5fe4c38aa57eccdaaf42bae05b750c0153828b09dab5891a6520ecad8
Size

86KB
MD5

90d02e555e0862ed6fc47366fa5f6ba0
SHA1

dcca0bfa4148cf0c4f196b40e4c4894277aedc8b
SHA256

e2ffa9f5fe4c38aa57eccdaaf42bae05b750c0153828b09dab5891a6520ecad8
SHA512

a9bc48043d8739faa1cd38127c099ba3126e458c0352ba24317f625ddfc511734ae429265264c0f48365d67536b1c151786addd3a7f1e4a22e4539e4ac9d2b2c
SSDEEP

1536:vcwcxYFDMbbMt9ODnjfiwKcuybfLIeEwKJB4AY4eEtVreOv3/d:EwoYFIMDODn+wKByrLIeNKJBZ2EtpeOt

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

e2ffa9f5fe4c38aa57eccdaaf42bae05b750c0153828b09dab5891a6520ecad8
.exe windows x86

4787cd63529b0ad601afe6815196f583

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
GetTickCount
GetTempPathA
CopyFileA
GetCommandLineA
GetLastError
GetCurrentProcess
CloseHandle
WriteFile
CreateFileA
GlobalFree
LockResource
GlobalAlloc
LoadResource
SizeofResource
FindResourceA
SetPriorityClass
GetCurrentThread
SetThreadPriority
ResumeThread
Sleep
GetSystemDirectoryA
OutputDebugStringA
CreateProcessA
lstrlenA
VirtualAllocEx
WriteProcessMemory
GetModuleHandleA
GetProcAddress
CreateRemoteThread
GetSystemWindowsDirectoryA
SetFileAttributesA
GetStartupInfoA

advapi32

RegisterServiceCtrlHandlerA
OpenSCManagerA
CreateServiceA
OpenServiceA
StartServiceA
CloseServiceHandle
RegQueryValueExA
StartServiceCtrlDispatcherA
RegCreateKeyA
RegOpenKeyExA
SetServiceStatus
RegOpenKeyA
RegDeleteValueA
RegSetValueExA
RegCloseKey

mfc42

ord924
ord537
ord941
ord535
ord800

msvcrt

__dllonexit
_onexit
_exit
_XcptFilter
__CxxFrameHandler
__getmainargs
_except_handler3
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strncmp
strstr
exit
_initterm
sprintf
_acmdln

msvcp60

??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ

Sections

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uyghur
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4787cd63529b0ad601afe6815196f583

Headers

File Characteristics

Imports

kernel32

advapi32

mfc42

msvcrt

msvcp60

Sections

.data Size: 9KB - Virtual size: 8KB

.rsrc Size: 76KB - Virtual size: 75KB

.uyghur Size: 512B - Virtual size: 340B

.data
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 76KB - Virtual size: 75KB

.uyghur
Size: 512B - Virtual size: 340B