gh0strat | 5028d4704a3255d7f741da72aed805082131d70d847cc896e3b89a56cd184145

Sharing

Copy URL Twitter E-mail

General

Target

5028d4704a3255d7f741da72aed805082131d70d847cc896e3b89a56cd184145
Size

101KB
MD5

41105dbf663b398b689621a6300c2bce
SHA1

983511c3f23d7a5c55f47c421dee80e86107d5ce
SHA256

5028d4704a3255d7f741da72aed805082131d70d847cc896e3b89a56cd184145
SHA512

b03e03476d9fcc6369eb7b8de0a2e957762e7f568cc7601540aaa5f239bb88c2a1503d2b984cc320aebd9e555808e51962a7a91fc67c5cbc2a62c86a09f71fcb
SSDEEP

1536:6YwdS7aWhswcVuHfi1i+88hLbCx2jVpqK0PmGPrxZ8m/uOg:6YwdS7fswKu/i1iRuVpqK0PxPrxam/1g

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

5028d4704a3255d7f741da72aed805082131d70d847cc896e3b89a56cd184145
.dll windows x86

74b0a7413c0775555e181cda971ed53a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
GetProcAddress
LoadLibraryA
CloseHandle
ResetEvent
lstrcpyA
SetEvent
InterlockedExchange
CancelIo
Sleep
lstrlenA
lstrcatA
GetWindowsDirectoryA
FreeLibrary
GetVersionExA
DeleteFileA
GetLastError
CreateDirectoryA
GetFileAttributesA
GetDriveTypeA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
GetModuleFileNameA
SetLastError
WinExec
GetCurrentProcess
VirtualAllocEx
OpenProcess
WaitForSingleObject
CreateThread
TerminateThread
GetLocalTime
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetTickCount
GetSystemDirectoryA
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GetSystemInfo
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
LocalSize
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcmpiA
GetCurrentThreadId
RaiseException

msvcrt

strrchr
strncpy
strncmp
sprintf
atoi
_errno
_snprintf
strtok
strncat
_except_handler3
wcstombs
_beginthreadex
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
free
malloc
strchr
??2@YAPAXI@Z
_CxxThrowException
__CxxFrameHandler
strstr
_ftol
ceil
realloc
memmove
_strnicmp
_strrev
_strnset
??3@YAXPAX@Z
_strcmpi

msvcp60

?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

msvfw32

ICCompressorFree
ICSeqCompressFrameEnd
ICSeqCompressFrame
ICSeqCompressFrameStart
ICClose
ICOpen
ICSendMessage

Exports

Exports

ServiceMain
aaaa
bbbb

Sections

999
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

222
Size: 18KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

000
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

666
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

333
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

555
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

444
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

111
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

777
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

888
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

74b0a7413c0775555e181cda971ed53a

Headers

File Characteristics

Imports

kernel32

msvcrt

msvcp60

msvfw32

Exports

Exports

Sections

999 Size: 4KB - Virtual size: 3KB

222 Size: 18KB - Virtual size: 19KB

000 Size: 35KB - Virtual size: 35KB

666 Size: 512B - Virtual size: 288B

333 Size: 7KB - Virtual size: 7KB

555 Size: 3KB - Virtual size: 2KB

444 Size: 2KB - Virtual size: 2KB

111 Size: 15KB - Virtual size: 15KB

777 Size: 4KB - Virtual size: 3KB

888 Size: 3KB - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 920B

.reloc Size: 6KB - Virtual size: 5KB

999
Size: 4KB - Virtual size: 3KB

222
Size: 18KB - Virtual size: 19KB

000
Size: 35KB - Virtual size: 35KB

666
Size: 512B - Virtual size: 288B

333
Size: 7KB - Virtual size: 7KB

555
Size: 3KB - Virtual size: 2KB

444
Size: 2KB - Virtual size: 2KB

111
Size: 15KB - Virtual size: 15KB

777
Size: 4KB - Virtual size: 3KB

888
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 920B

.reloc
Size: 6KB - Virtual size: 5KB