Behavioral task
behavioral1
Sample
4d2f6fa3ee31b76c56ddd00f850fe14d6483af4470b845d0ad6588c3733a3bdb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4d2f6fa3ee31b76c56ddd00f850fe14d6483af4470b845d0ad6588c3733a3bdb.exe
Resource
win10v2004-20220812-en
General
-
Target
4d2f6fa3ee31b76c56ddd00f850fe14d6483af4470b845d0ad6588c3733a3bdb
-
Size
86KB
-
MD5
900414ed866a1056a39ebc9925ce2570
-
SHA1
e2a2fbf9e1f03c020ca38530778de3537fead38c
-
SHA256
4d2f6fa3ee31b76c56ddd00f850fe14d6483af4470b845d0ad6588c3733a3bdb
-
SHA512
c7835dee0c588fe94f7f48f35ebd1a7d7ac7556675cdebd7d633f62a8cda7d9da1bfda03e64ebdf6cc389b9f835391349c4259576edb33d208969385a84b1a90
-
SSDEEP
1536:wZ6x1MrdR5t00caYefsNKv+bLeEtJFAIq8no:Dx1YvT00dYYsNKWveQJaIq8no
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
4d2f6fa3ee31b76c56ddd00f850fe14d6483af4470b845d0ad6588c3733a3bdb.exe windows x86
1f417fb442f81488c26f7e3c668e3205
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OutputDebugStringA
GetModuleHandleA
CreateThread
SetErrorMode
OpenEventA
GetTickCount
ReleaseMutex
GetLastError
GetVersionExA
WriteFile
InitializeCriticalSection
GetStartupInfoA
DeleteFileA
MoveFileA
TerminateThread
CreateProcessA
GetModuleFileNameA
CreateFileA
LocalFree
GetDriveTypeA
lstrlenA
Sleep
SetEvent
lstrcpyA
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
LoadLibraryA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
user32
GetThreadDesktop
CharNextA
OpenDesktopA
wsprintfA
SetProcessWindowStation
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
ExitWindowsEx
GetProcessWindowStation
OpenWindowStationA
advapi32
RegDeleteValueA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueA
RegCloseKey
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
shell32
SHGetFileInfoA
ole32
CoInitialize
CoUninitialize
CoCreateInstance
msvcrt
__setusermatherr
_strrev
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
_initterm
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
memmove
ceil
_ftol
strstr
??2@YAPAXI@Z
free
malloc
_except_handler3
strrchr
rename
strchr
atoi
_beginthreadex
calloc
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
ws2_32
socket
gethostbyname
htons
connect
ntohs
WSAIoctl
WSACleanup
WSAStartup
closesocket
recv
gethostname
send
getsockname
select
setsockopt
msvcp60
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
wininet
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ