gh0strat | 44e0ab1dddd96112ead3687122d9bd46949196c28245d519206037c85498d336

Sharing

Copy URL Twitter E-mail

General

Target

44e0ab1dddd96112ead3687122d9bd46949196c28245d519206037c85498d336
Size

548KB
MD5

904e77c46e65bd0d82d5f95716e800b0
SHA1

7e615d865fc1e7e91ee87a54399618974ae5311b
SHA256

44e0ab1dddd96112ead3687122d9bd46949196c28245d519206037c85498d336
SHA512

595e83a3ecae8b025c61e480655e872e268153b31ebf063f6ea1f0e5a296e552560a3dfe9f43447a2871877cd2b4c6df232706ca92be8cf60227aef63914398e
SSDEEP

12288:i+M51/WoeWFt++yr+TlkWy9WABUlAiEFsH9h8sBYb:i+M51/KWFt++yr+TlkWydBUAikk0uYb

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

44e0ab1dddd96112ead3687122d9bd46949196c28245d519206037c85498d336
.exe windows x86

1058783fc0766c2048444c6c8c9214b9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
GlobalMemoryStatus
GetTickCount
GetPriorityClass
GetModuleFileNameA
GetCurrentThread
GetThreadPriority
SetPriorityClass
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GlobalLock
GlobalAlloc
GlobalUnlock
HeapAlloc
HeapFree
Sleep
FindFirstFileA
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDriveTypeA
lstrlenA
GetFileAttributesA
CreateDirectoryA
InterlockedExchange
lstrcpyA
ResetEvent
WideCharToMultiByte
LeaveCriticalSection
LoadLibraryA
GetSystemInfo
GetProcAddress
LocalAlloc
FreeLibrary
RtlUnwind
ExitProcess
TerminateProcess
GetLastError
CreateThread
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
RaiseException
TlsAlloc
SetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
WriteFile
CloseHandle
InterlockedDecrement
InterlockedIncrement
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
FlushFileBuffers
SetFilePointer
LCMapStringA
LCMapStringW

gdi32

GetDIBits
CreateCompatibleBitmap
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject

advapi32

RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegQueryValueA
RegCloseKey

shell32

SHGetFileInfoA

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize

oleaut32

SysFreeString

Sections

.text
Size: 475KB - Virtual size: 475KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 21KB - Virtual size: 488KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1058783fc0766c2048444c6c8c9214b9

Headers

File Characteristics

Imports

kernel32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 475KB - Virtual size: 475KB

.data Size: 21KB - Virtual size: 488KB

.rsrc Size: 51KB - Virtual size: 50KB

.text
Size: 475KB - Virtual size: 475KB

.data
Size: 21KB - Virtual size: 488KB

.rsrc
Size: 51KB - Virtual size: 50KB