gh0strat | 20e2f5c67ab0c4b313ef53fadf2fb33af5de160faea3229d14fd3bfd93e46f90

Sharing

Copy URL Twitter E-mail

General

Target

20e2f5c67ab0c4b313ef53fadf2fb33af5de160faea3229d14fd3bfd93e46f90
Size

152KB
MD5

a39508abfa22a000cd53c174938b2550
SHA1

e73e63ceeb405943b011b575fca278823b497890
SHA256

20e2f5c67ab0c4b313ef53fadf2fb33af5de160faea3229d14fd3bfd93e46f90
SHA512

8b0146bbca6520ba67e1446bfae1fa44620c0c2ea4de85178bd607f8c896d1356f32257ee64d6bea92f1b478320b0e2b5d3220a9df94b7625b12cd690be480a5
SSDEEP

3072:JfaOrcfF4Q/Sl6RPRnP/qYqsn/spMwXq2BzTBft96ziS:Jf6K8lRP/fqsnwMmxBzTBlD

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

20e2f5c67ab0c4b313ef53fadf2fb33af5de160faea3229d14fd3bfd93e46f90
.dll windows x86

325f797338d0103ecef05751b0a80db6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetSystemDirectoryA
VirtualQuery
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
HeapAlloc
GlobalFree
GlobalAlloc
FreeLibrary
GetCurrentThreadId
lstrcmpiA
GetShortPathNameA
GetTempFileNameA
GetProcAddress
GetVersionExA
GetModuleHandleA
GetSystemInfo
GetProcessTimes
LeaveCriticalSection
GlobalMemoryStatusEx
DeleteFileA
RemoveDirectoryA
ExitThread
GetModuleFileNameA
IsBadReadPtr
IsBadStringPtrW
MultiByteToWideChar
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetCommandLineA
GetCurrentProcessId
GetFileAttributesExA
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
InterlockedExchange
GetLastError
GetTickCount
GetCurrentProcess
InitializeCriticalSection
LoadLibraryA
RaiseException
LocalAlloc

advapi32

RegRestoreKeyA
RegSaveKeyA
RegOpenKeyExW
RegisterServiceCtrlHandlerExA

shlwapi

SHDeleteKeyA

user32

wvsprintfA
GetWindowRect
EnableWindow
ShowWindow
GetWindow
GetClassNameA
DestroyWindow
CreateWindowExA
CloseWindowStation
MessageBoxA
GetCursorInfo
PtInRect
DestroyCursor
CopyRect
wsprintfA
LoadCursorA
SendMessageTimeoutA

msvcrt

malloc
atoi
_onexit
__dllonexit
_adjust_fdiv
_initterm
_stricmp
_strlwr
_memicmp
_wcsicmp
_strupr
realloc
wcslen
_callnewh
__CxxFrameHandler
strncpy
_ftol
memmove
ceil
strchr
strncat
_except_handler3
free
time
strrchr
_beginthreadex
rand
srand
wcstombs

Exports

Exports

A_SHAFinal
A_SHAInit
A_SHAUpdate
AbortSystemShutdownA
AbortSystemShutdownW
AccessCheck
AccessCheckAndAuditAlarmA
AccessCheckAndAuditAlarmW
AccessCheckByType
AccessCheckByTypeAndAuditAlarmA
AccessCheckByTypeAndAuditAlarmW
AccessCheckByTypeResultList
AccessCheckByTypeResultListAndAuditAlarmA
AccessCheckByTypeResultListAndAuditAlarmByHandleA
AccessCheckByTypeResultListAndAuditAlarmByHandleW
AccessCheckByTypeResultListAndAuditAlarmW
AddAccessAllowedAce
AddAccessAllowedAceEx
AddAccessAllowedObjectAce
AddAccessDeniedAce
AddAccessDeniedAceEx
AddAccessDeniedObjectAce
AddAce
AddAuditAccessAce
AddAuditAccessAceEx
AddAuditAccessObjectAce
AddUsersToEncryptedFile
AdjustTokenGroups
AdjustTokenPrivileges
AllocateAndInitializeSid
AllocateLocallyUniqueId
AreAllAccessesGranted
AreAnyAccessesGranted
BackupEventLogA
BackupEventLogW
BuildExplicitAccessWithNameA
BuildExplicitAccessWithNameW
BuildImpersonateExplicitAccessWithNameA
BuildImpersonateExplicitAccessWithNameW
BuildImpersonateTrusteeA
BuildImpersonateTrusteeW
BuildSecurityDescriptorA
BuildSecurityDescriptorW
BuildTrusteeWithNameA
BuildTrusteeWithNameW
BuildTrusteeWithObjectsAndNameA
BuildTrusteeWithObjectsAndNameW
BuildTrusteeWithObjectsAndSidA
BuildTrusteeWithObjectsAndSidW
BuildTrusteeWithSidA

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 294B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

325f797338d0103ecef05751b0a80db6

Headers

File Characteristics

Imports

kernel32

advapi32

shlwapi

user32

msvcrt

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 99KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 294B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 99KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 294B

.reloc
Size: 8KB - Virtual size: 7KB