gh0strat | 7a007d76c8d4954777664a135c451cb57c77e7feca3d196e1c96ddad2041d3cc | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7a007d76c8d4954777664a135c451cb57c77e7feca3d196e1c96ddad2041d3cc
Size

147KB
MD5

a352fb33efff2936139ab41afe357bf0
SHA1

b4fad77904ec2c7dc0cdf6dfb262608572bad10e
SHA256

7a007d76c8d4954777664a135c451cb57c77e7feca3d196e1c96ddad2041d3cc
SHA512

f9d4d98e5a735a3aec6a5db41d7a681733fef44d2218ec4fb5939f9b9b74cfd87a6b0087f2769ab4835b098115a126ce53f8880c37872a6818f43f218d03488f
SSDEEP

3072:CwwIbaAodB4igMHMdNLhgIxhGmW/aQ0lvmI3sSQ9niQnq3azO/mo:CwwIbaAe4ivHMfhgIxhG/Uvmg+9ivaST

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

7a007d76c8d4954777664a135c451cb57c77e7feca3d196e1c96ddad2041d3cc
.exe windows x86

8a2200329f6ee1ca5783e277d5263d07

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
Sleep
LoadLibraryA
GetProcAddress
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
GetModuleHandleA

advapi32

GetLengthSid
CreateServiceA
GetUserNameA
RegDeleteValueA
RegDeleteKeyA
EqualSid
GetAce
InitializeAcl
GetAclInformation
RegCreateKeyExA

msvcrt

strcat
__CxxFrameHandler
strchr
??3@YAXPAX@Z
strstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
memcpy
??2@YAPAXI@Z
memset
strlen
malloc
realloc
_except_handler3
_CxxThrowException

Sections

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.AirCmd
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ