gh0strat | 25c032d463196531adab57fda74c7bf12eaca32cce32e889563fbc350cb3094e

Sharing

Copy URL Twitter E-mail

General

Target

25c032d463196531adab57fda74c7bf12eaca32cce32e889563fbc350cb3094e
Size

124KB
MD5

04a6b15ad523b5b8e1661bc418260dc6
SHA1

997e45be43534b6755a7645af3b46db907ee0ceb
SHA256

25c032d463196531adab57fda74c7bf12eaca32cce32e889563fbc350cb3094e
SHA512

8dc5ed61b8e618a46951f551bbfbfd2fd53792c9cd38fd8008ab39d7a1eab37a7319f4faeb84e6792185edcc42f7bb9ae3168edf464438d329dab0267d8c3ccc
SSDEEP

1536:CGuKURLdsYWTqh4uR5N3v+ic6a2fCleyw65c5Oewm3SA:CGGJsorRr3n9agCleywuc5Oewg/

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

25c032d463196531adab57fda74c7bf12eaca32cce32e889563fbc350cb3094e
.exe windows x86

4909ca115775b3b4813d3e247518bdad

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventA
CloseHandle
GetProcAddress
LoadLibraryA
SetEvent
ResumeThread
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
ResetEvent
lstrcpyA
InterlockedExchange
Sleep
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
GetWindowsDirectoryA
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
CreateDirectoryA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
LocalFree
LocalAlloc
RemoveDirectoryA
CreateFileA
WriteFile
ReadFile
SetFilePointer
GetModuleFileNameA
GetLastError
ExitProcess
GetCurrentProcess
GetVersion
DeviceIoControl
WaitForSingleObject
GetLocalTime
GlobalFree
GlobalUnlock
GetTickCount
SetErrorMode
CreateMutexA
GetStartupInfoA
RaiseException
GetModuleHandleA

msvcrt

atoi
strncmp
_errno
wcscpy
_beginthreadex
calloc
_exit
_XcptFilter
strncpy
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
rename
strrchr
_except_handler3
free
malloc
strchr
strstr
_ftol
ceil
memmove
exit
_strnicmp
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

msvfw32

ICCompressorFree
ICSeqCompressFrameEnd
ICOpen
ICSendMessage
ICSeqCompressFrameStart
ICSeqCompressFrame
ICClose

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.uyghur
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4909ca115775b3b4813d3e247518bdad

Headers

File Characteristics

Imports

kernel32

msvcrt

msvcp60

msvfw32

Sections

.text Size: 80KB - Virtual size: 80KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 16KB - Virtual size: 16KB

.rsrc Size: 4KB - Virtual size: 4KB

.uyghur Size: 4KB - Virtual size: 4KB

.text
Size: 80KB - Virtual size: 80KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 4KB

.uyghur
Size: 4KB - Virtual size: 4KB