Behavioral task
behavioral1
Sample
b960f0f9adc234916883e4c8a314fdfc711d20b5a15f924c9b8a1783c96d7c55.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b960f0f9adc234916883e4c8a314fdfc711d20b5a15f924c9b8a1783c96d7c55.exe
Resource
win10v2004-20220812-en
General
-
Target
b960f0f9adc234916883e4c8a314fdfc711d20b5a15f924c9b8a1783c96d7c55
-
Size
544KB
-
MD5
4e796889889ffb7b9494c3ba57b3c004
-
SHA1
47af2c03a956715fd60e4798c9918b57f561f4fd
-
SHA256
b960f0f9adc234916883e4c8a314fdfc711d20b5a15f924c9b8a1783c96d7c55
-
SHA512
2466ee368cbf34d1cfcd6a1d8a1a4c84c4e3c9259d888ba84532b7929379fb4abd6164d2436522f6001c4453ef7643ae7440bd8fd03531baa80b249d9368c846
-
SSDEEP
12288:y1M53Wti/XneXRmzlUcBjDr+TybNUlWTkTW+b5YJfcI:y1M53Wti5lUcBjDr+TybNU2kq+WFcI
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
b960f0f9adc234916883e4c8a314fdfc711d20b5a15f924c9b8a1783c96d7c55.exe windows x86
91f8d884714e0d47c6e9cfc5df8fd272
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
avicap32
capGetDriverDescriptionA
kernel32
GlobalMemoryStatus
GetTickCount
GlobalLock
GetCurrentProcess
GetStartupInfoA
OpenProcess
GetPriorityClass
GetCurrentThread
GetThreadPriority
SetPriorityClass
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameA
GlobalAlloc
GlobalUnlock
HeapAlloc
HeapFree
MultiByteToWideChar
Sleep
DeviceIoControl
GetVersion
MoveFileA
LocalAlloc
FindFirstFileA
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDriveTypeA
GetFileAttributesA
CreateDirectoryA
GetPrivateProfileStringA
lstrcmpA
FreeLibrary
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
InterlockedExchange
lstrcpyA
ResetEvent
WideCharToMultiByte
LeaveCriticalSection
LoadLibraryA
GetProcAddress
GetSystemInfo
LCMapStringW
LCMapStringA
SetFilePointer
FlushFileBuffers
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
InterlockedIncrement
InterlockedDecrement
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
CloseHandle
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
RtlUnwind
ExitProcess
TerminateProcess
GetLastError
CreateThread
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetModuleHandleA
GetCommandLineA
TlsAlloc
SetLastError
RaiseException
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
gdi32
GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
advapi32
LookupAccountNameA
LsaClose
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegQueryValueA
RegCloseKey
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
IsValidSid
shell32
SHGetSpecialFolderPathA
SHGetFileInfoA
ole32
CoUninitialize
CoInitialize
CoTaskMemFree
CoCreateInstance
oleaut32
SysFreeString
winmm
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveOutClose
waveOutWrite
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutReset
waveOutUnprepareHeader
waveInStart
urlmon
URLDownloadToFileA
netapi32
NetUserAdd
NetLocalGroupAddMembers
psapi
EnumProcessModules
GetModuleFileNameExA
wtsapi32
WTSQuerySessionInformationA
WTSFreeMemory
Sections
.text Size: 498KB - Virtual size: 498KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 23KB - Virtual size: 491KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ