gh0strat | 490337c729ea7d0af3dfcffd62e87b53e3dc087068b631337fd1be63044ea64f

General

Target

490337c729ea7d0af3dfcffd62e87b53e3dc087068b631337fd1be63044ea64f
Size

149KB
MD5

07ec407bd871c99a63911353e8972380
SHA1

ff0f03b16d2b03a24326228f1a7255d32bae98ec
SHA256

490337c729ea7d0af3dfcffd62e87b53e3dc087068b631337fd1be63044ea64f
SHA512

b4d9c67dec6ceb6b00163b1aeb6b79bdde5f4000d219653b1e098085deee44de029082aac047e4c8b25ef6221bfac54a6f9c404a082058a2a702ff99b63425b1
SSDEEP

3072:3enQFr01f3CbhZxIdlBGYuixszSPvi+wXNdG3WC/ASErCEQD:3enQFr0Z3QhnIDlu24SP6+wXNCWzQD

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

490337c729ea7d0af3dfcffd62e87b53e3dc087068b631337fd1be63044ea64f
.exe windows x86

72f36946b5756ecb1f0f00971f3ac5f3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
FreeLibrary
GetWindowsDirectoryA
GetTempPathA
GetLastError
HeapFree
HeapAlloc
GetProcessHeap
lstrcatA
Sleep
WinExec
GetLocalTime
CopyFileA
lstrcpyA
lstrcmpA
GetModuleFileNameA
DeleteFileA
ExitProcess
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
MultiByteToWideChar
MoveFileA
lstrlenA
SizeofResource
SetFileTime
LoadResource
GetTickCount
lstrcmpiA
SetLastError
ReadFile
SetFilePointer
CreateThread
SetUnhandledExceptionFilter
GetCurrentThreadId
RaiseException
InterlockedExchange
LocalAlloc
GetStartupInfoA
GetModuleHandleA

msvcrt

strtok
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_strnset
_strrev
sprintf
strchr
malloc
realloc
_except_handler3
_stricmp

iphlpapi

AddIPAddress
GetInterfaceInfo

Sections

333
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

222
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

111
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 130KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

72f36946b5756ecb1f0f00971f3ac5f3

Headers

File Characteristics

Imports

kernel32

msvcrt

iphlpapi

Sections

333 Size: 12KB - Virtual size: 11KB

222 Size: 4KB - Virtual size: 3KB

111 Size: 2KB - Virtual size: 2KB

.rsrc Size: 130KB - Virtual size: 131KB

333
Size: 12KB - Virtual size: 11KB

222
Size: 4KB - Virtual size: 3KB

111
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 130KB - Virtual size: 131KB