gh0strat | 7e5d536a25ba23175cfc8db5e0791f8b8a93d72f148b2fc09aacf164eef5c5e7

General

Target

7e5d536a25ba23175cfc8db5e0791f8b8a93d72f148b2fc09aacf164eef5c5e7
Size

428KB
MD5

8438cb570487272a2efdeba42c1ae790
SHA1

298e7c6b1260fb6c9067f5a0798191ad41cff20b
SHA256

7e5d536a25ba23175cfc8db5e0791f8b8a93d72f148b2fc09aacf164eef5c5e7
SHA512

e57644a3153f7f361922b9b311bba2c89066fb1fb74850da0f454f16b765a0c53d6a0a24d1a9dd78e9efa9c5da8a174e9965f81a60095dafd0390b06cf716dd9
SSDEEP

12288:JkF5ETKAPT3Mvvvvvvvvvvvvvvvvvvvvvvv6AvvYhq/9NIndSYv44VwxNv3vvvvm:C5WK6T3Mvvvvvvvvvvvvvvvvvvvvvvvw

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

7e5d536a25ba23175cfc8db5e0791f8b8a93d72f148b2fc09aacf164eef5c5e7
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

AddMRUStringW
CreateMRUListW
CreateMappedBitmap
CreatePropertySheetPage
CreatePropertySheetPageA
CreatePropertySheetPageW
CreateStatusWindow
CreateStatusWindowA
CreateStatusWindowW
CreateToolbar
CreateToolbarEx
CreateUpDownControl
DPA_Create
DPA_DeleteAllPtrs
DPA_DeletePtr
DPA_Destroy
DPA_DestroyCallback
DPA_EnumCallback
DPA_GetPtr
DPA_InsertPtr
DPA_Search
DPA_SetPtr
DPA_Sort
DSA_Create
DSA_DeleteAllItems
DSA_Destroy
DSA_DestroyCallback
DSA_GetItemPtr
DSA_InsertItem
DefSubclassProc
DestroyPropertySheetPage
DllGetVersion
DllInstall
DrawInsert
DrawStatusText
DrawStatusTextA
DrawStatusTextW
EnumMRUListW
FlatSB_EnableScrollBar
FlatSB_GetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollProp
FlatSB_GetScrollRange
FlatSB_SetScrollInfo
FlatSB_SetScrollPos
FlatSB_SetScrollProp
FlatSB_SetScrollRange
FlatSB_ShowScrollBar
FreeMRUList
GetEffectiveClientRect

Sections

.text
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 98KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 12KB - Virtual size: 15KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 100KB - Virtual size: 98KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 12KB - Virtual size: 15KB

.reloc
Size: 8KB - Virtual size: 6KB