gh0strat | 747d65279cea6960124ef17981a8179b2701feee77ea8889dc308d4fb6417b45

Sharing

Copy URL

Twitter E-mail

General

Target

747d65279cea6960124ef17981a8179b2701feee77ea8889dc308d4fb6417b45
Size

296KB
MD5

0720076ef1c38a82c256316aa92fa7d5
SHA1

c560b0b35a840b3305afb2ad52101789e27b5dda
SHA256

747d65279cea6960124ef17981a8179b2701feee77ea8889dc308d4fb6417b45
SHA512

035c0ffab629cc7f43425dd44eac0595134bc2426131faac87da7c69dc4ee10326819725c102c92669dc275e33f2a567985d884ef853ae695556ff78f10265e3
SSDEEP

3072:jF8D8H/yshvKjgBU2Bb5wiKf73ifety7jjuIDvzt8a:jFxyshy0FB9BKf736vjuIDr

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

747d65279cea6960124ef17981a8179b2701feee77ea8889dc308d4fb6417b45
.exe windows x86

8ee024f3c36e2cc131b1bf1271463b4b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringA
LCMapStringW
GetACP
GetOEMCP
SetStdHandle
FlushFileBuffers
CloseHandle
LoadLibraryA
GetProcAddress
GetCPInfo
SetFilePointer
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
RtlUnwind
RaiseException
HeapAlloc
HeapFree
GetLastError
MoveFileA
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
HeapSize
InterlockedDecrement
InterlockedIncrement
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
WriteFile
IsBadReadPtr

user32

DispatchMessageA
TranslateMessage
CharNextA
EnumWindows
GetForegroundWindow
IsWindow
SendMessageA
CreateWindowExA
ShowWindow
GetCursorPos
GetDC
SetRect
GetSystemMetrics
EmptyClipboard
CloseClipboard
SystemParametersInfoA

gdi32

GetDIBits
CreateDIBSection
CreateCompatibleDC
DeleteObject
DeleteDC
BitBlt

winmm

waveOutClose

ws2_32

__WSAFDIsSet
htons

Sections

.text
Size: 240KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8ee024f3c36e2cc131b1bf1271463b4b

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winmm

ws2_32

Sections

.text Size: 240KB - Virtual size: 237KB

.data Size: 36KB - Virtual size: 54KB

.rodata Size: 12KB - Virtual size: 10KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 240KB - Virtual size: 237KB

.data
Size: 36KB - Virtual size: 54KB

.rodata
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 4KB - Virtual size: 1KB