gh0strat | e07846e3ea012843a42fdb521a45545a5b365b413fe7f53bb9f10e5d2b2c773f

Sharing

Copy URL

Twitter E-mail

General

Target

e07846e3ea012843a42fdb521a45545a5b365b413fe7f53bb9f10e5d2b2c773f
Size

123KB
MD5

3d3c6a3cc1c227e39eae898d86e2e9a0
SHA1

8070ff33920b4429c6b8c5f051b2b0cef0b339b7
SHA256

e07846e3ea012843a42fdb521a45545a5b365b413fe7f53bb9f10e5d2b2c773f
SHA512

081bce1af681d77243e496e4bc0992e8dbcb9b6594c32006e05086088a703c6a61b5b048cbfd3690f545e76ce6a1b6dee8a846e3ba4b57f84adfa1a5963e60c5
SSDEEP

1536:5KGFVTO6Ou/izV1jaeb7HOFUlRILcaZjfRxS/4ZP73TvhY7z9bRzM:0GFlOu/nOOFUlRIL5ZDRxSejvhY7BZM

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

e07846e3ea012843a42fdb521a45545a5b365b413fe7f53bb9f10e5d2b2c773f
.dll windows x86

a585c5b0844f6ff0936dbfa7368d1e86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
MapViewOfFile
CreateFileMappingA
HeapAlloc
UnmapViewOfFile
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
HeapFree
PeekNamedPipe
WaitForMultipleObjects
DeviceIoControl
GlobalMemoryStatus
GetSystemDirectoryA
OpenEventA
SetErrorMode
SetUnhandledExceptionFilter
LocalSize
lstrcmpiA
GetCurrentThreadId
GetTickCount
GetLocalTime
MoveFileExA
InterlockedExchange
GetCurrentProcess
GetWindowsDirectoryA
CreateToolhelp32Snapshot
Process32First
Process32Next
SetLastError
GetModuleFileNameA
MoveFileA
WriteFile
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetDiskFreeSpaceExA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
CreateEventA
ExpandEnvironmentStringsA
lstrcatA
lstrlenA
GetPrivateProfileSectionNamesA
OpenProcess
Sleep
CancelIo
lstrcpyA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
FreeLibrary
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
LoadLibraryA
RaiseException
GetProcAddress
TerminateThread
CloseHandle
TerminateProcess

gdi32

BitBlt
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
GetDIBits
SelectObject
DeleteDC
DeleteObject

advapi32

AdjustTokenPrivileges
IsValidSid
LookupAccountNameA
LsaOpenPolicy
GetTokenInformation
LookupAccountSidA
DuplicateTokenEx
SetTokenInformation
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
LookupPrivilegeValueA
OpenEventLogA
ClearEventLogA
CloseEventLog
RegCreateKeyExA
CreateProcessAsUserA
OpenProcessToken
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueA
RegCloseKey
LsaFreeMemory

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA

msvcrt

strrchr
atoi
exit
strncat
strchr
realloc
rand
srand
strtok
malloc
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
_strcmpi
_stricmp
free
_except_handler3
_CxxThrowException
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
_beginthreadex
??2@YAPAXI@Z
_strnicmp

winmm

waveOutPrepareHeader
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveOutGetNumDevs
waveInGetNumDevs
waveInUnprepareHeader
waveOutWrite
waveOutOpen
waveInStart

ws2_32

WSAStartup
WSACleanup
getsockname
gethostname
recv
send
select
ntohs
WSAIoctl
socket
gethostbyname
htons
connect
setsockopt
closesocket

userenv

GetProfilesDirectoryA
GetUserProfileDirectoryA

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB

imm32

ImmGetContext
ImmGetCompositionStringA
ImmReleaseContext

wininet

InternetOpenUrlA
InternetOpenA
InternetReadFile
InternetCloseHandle

msvfw32

ICSendMessage
ICClose
ICSeqCompressFrameStart
ICSeqCompressFrameEnd

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationA

psapi

GetProcessMemoryInfo
GetModuleFileNameExA
EnumProcessModules

Exports

Exports

bbbbbbbbbbbb
cccccccccccc
hi
zzzzzzzzzzzzz

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a585c5b0844f6ff0936dbfa7368d1e86

Headers

File Characteristics

Imports

kernel32

gdi32

advapi32

shell32

msvcrt

winmm

ws2_32

userenv

msvcp60

imm32

wininet

msvfw32

wtsapi32

psapi

Exports

Exports

Sections

.text Size: 77KB - Virtual size: 77KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 8KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 77KB - Virtual size: 77KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 5KB - Virtual size: 5KB