gh0strat | 15d01fabd2fdfe27bfffb7e3e75595ec85a8bc4ecd886b52f31c98680d7ae476 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15d01fabd2fdfe27bfffb7e3e75595ec85a8bc4ecd886b52f31c98680d7ae476
Size

152KB
MD5

75d3cfbcb7fdf72ba6d40a9722bab57e
SHA1

875a4ad3cf7ca7701eeb58a690b4a8a3b5167165
SHA256

15d01fabd2fdfe27bfffb7e3e75595ec85a8bc4ecd886b52f31c98680d7ae476
SHA512

70ca82c7f12b000d4e2eb502c478e23a68abba20babf9c5c005ae1e625d69b9dfc319ba71d808aff77f6c466f91b12bfac703c811c425c6f9a41c96b9c835041
SSDEEP

3072:lBtSf+yOmPD8IRr+PqbssYPx5HcTBfthHr5lnFPn:lBTyPRqyhYPbHcTBlhHrHndn

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

15d01fabd2fdfe27bfffb7e3e75595ec85a8bc4ecd886b52f31c98680d7ae476
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

NPAddConnection
NPAddConnection3
NPCancelConnection
NPCloseEnum
NPEnumResource
NPGetCaps
NPGetConnection
NPGetResourceInformation
NPGetResourceParent

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ