gh0strat | abac00095dd648d668e393b3bddd5abcb270aff6952259d5bdcec65e4f761d13

General

Target

abac00095dd648d668e393b3bddd5abcb270aff6952259d5bdcec65e4f761d13
Size

258KB
MD5

823de697b9aa949f44e5b9d686e42ea0
SHA1

965da259a27224f714fa293470e75ba215a629ee
SHA256

abac00095dd648d668e393b3bddd5abcb270aff6952259d5bdcec65e4f761d13
SHA512

5703cec7ce00c49866c90dfa3753df4a0437e7799225342824c4806ad6316d5e85cfc7aa223248745bda57fb16d398ad34a31949f7c7667f9542684192676d70
SSDEEP

3072:Y2k8aZt0qgsTkXLao3pq6SEzclZ/1YqOAtiTBzh8t3ZsGZntvv:/zawCTkX+o3pHG1TZtiTBzh8t3WYN

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

abac00095dd648d668e393b3bddd5abcb270aff6952259d5bdcec65e4f761d13
.exe windows x86

9a128c7fa8c031a4a5a9c2ed7dd84308

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
FreeLibrary
SizeofResource
LockResource
FindResourceA
CreateDirectoryA
GetTickCount
DeleteFileA
FreeResource
CloseHandle
WriteFile
MultiByteToWideChar
lstrlenA
CreateFileA
GetLocalTime
Sleep
ExitProcess
WinExec
CopyFileA
MoveFileExA
MoveFileA
GetModuleFileNameA
GetLastError
GetCurrentProcess
HeapFree
HeapAlloc
LocalAlloc
InterlockedExchange
RaiseException
GetFileAttributesA
HeapReAlloc
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
VirtualFree
VirtualAlloc
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetStdHandle
FlushFileBuffers
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
ReadFile
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9a128c7fa8c031a4a5a9c2ed7dd84308

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 11KB - Virtual size: 16KB

.rsrc Size: 218KB - Virtual size: 217KB

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 11KB - Virtual size: 16KB

.rsrc
Size: 218KB - Virtual size: 217KB