gh0strat | 7f0d9e66144c183cfded6beafba8965656a1d93f776b8d6ddf2bc634f58b6664

Sharing

Copy URL Twitter E-mail

General

Target

7f0d9e66144c183cfded6beafba8965656a1d93f776b8d6ddf2bc634f58b6664
Size

104KB
MD5

35ff80667cf8c14ec1784f893a462910
SHA1

68de7361434ae59da516a87b56cc9c7e2ea157af
SHA256

7f0d9e66144c183cfded6beafba8965656a1d93f776b8d6ddf2bc634f58b6664
SHA512

68a4eae6c7ae68c0eac303fc4245b2730a722401930677e7383da45a937a74cb5abb1a5873b544afaf84f78901b5ee4b13a24f53c693daebc8689cbae2ac298d
SSDEEP

3072:oDpVU0yJR1w4dKZUVc+qJwVU6qQ7MO2J7r:oDpVUtD24dmGJVVrXAfJ7r

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

7f0d9e66144c183cfded6beafba8965656a1d93f776b8d6ddf2bc634f58b6664
.exe windows x86

9d2b1840cf2d6fe9105ea6541babe953

Code Sign

f9:02:51:ed:3d:06:d1:82:ee:db:a5:94:68:fc:04:eb:62:35:f9:21
Signer

Actual PE Digest

f9:02:51:ed:3d:06:d1:82:ee:db:a5:94:68:fc:04:eb:62:35:f9:21

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

NO CERTIFICATE

01/01/0001, 00:00
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SystemTimeToFileTime
CreateFileA
LoadResource
FindResourceA
lstrcatA
GetTempPathA
GetFileAttributesA
GetSystemDirectoryA
LocalFileTimeToFileTime
lstrlenA
GetModuleFileNameA
SetUnhandledExceptionFilter
ReleaseMutex
GetLastError
CreateMutexA
GetCommandLineA
GetCurrentThreadId
SetFileTime
SizeofResource
WriteFile
CloseHandle
MoveFileA
SetFileAttributesA
DeleteFileA
ExitProcess
Sleep
OutputDebugStringA

user32

GetMessageA
EnumWindows
GetClassNameA
SetWindowPos
PostThreadMessageA
GetInputState

advapi32

RegCreateKeyExA
RegCloseKey
StartServiceA
ControlService
ChangeServiceConfigA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
RegSetValueExA

msvcrt

_mbsstr

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9d2b1840cf2d6fe9105ea6541babe953

Code Sign

f9:02:51:ed:3d:06:d1:82:ee:db:a5:94:68:fc:04:eb:62:35:f9:21Signer

Signature Validations

Verification

01/01/0001, 00:00 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

Sections

.text Size: 2KB - Virtual size: 2KB

INIT Size: 1KB - Virtual size: 1KB

.rsrc Size: 99KB - Virtual size: 99KB

.reloc Size: 512B - Virtual size: 502B

f9:02:51:ed:3d:06:d1:82:ee:db:a5:94:68:fc:04:eb:62:35:f9:21
Signer

01/01/0001, 00:00
Valid: false

.text
Size: 2KB - Virtual size: 2KB

INIT
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 99KB - Virtual size: 99KB

.reloc
Size: 512B - Virtual size: 502B