gh0strat | c02453eb16c9a99331de78b2963c983254846395b50d58dfab34bec27a88fffb

Sharing

Copy URL Twitter E-mail

General

Target

c02453eb16c9a99331de78b2963c983254846395b50d58dfab34bec27a88fffb
Size

62KB
MD5

14243511699fb95e35afa89b877c9b10
SHA1

0b6a066de20b38defe8bd5c5d1a6fd822aa325d9
SHA256

c02453eb16c9a99331de78b2963c983254846395b50d58dfab34bec27a88fffb
SHA512

0d4e2c416e72121963b6b2f17fa9a5ffa826bbfdaf100399641e7a8d3a75ab6f38c06f8eed6e05093c597c1241721577ba662f4669c45eb6febe826bc59ca8d7
SSDEEP

1536:9NUKmrOycT4sf1Iesvy0Xvd6pzTf9MWJyM:9CKmrOyM4O1Iesvy7p/f9MWt

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

c02453eb16c9a99331de78b2963c983254846395b50d58dfab34bec27a88fffb
.exe windows x86

eb16ecd01f171b0920c0216f07f889c8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
GetCurrentProcessId
HeapAlloc
GetProcessHeap
CreateProcessA
lstrcpyA
TerminateThread
DeleteFileA
lstrcatA
GetSystemDirectoryA
ExitProcess
SetFileAttributesA
GetModuleFileNameA
ReleaseMutex
OpenMutexA
GlobalMemoryStatus
GetLocalTime
OpenEventA
ResumeThread
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
GetEnvironmentVariableA
GetShortPathNameA
SetErrorMode
CreateMutexA
WinExec
SetUnhandledExceptionFilter
lstrlenA
CopyFileA
GetCurrentThreadId
WriteFile
CreateFileA
GetStartupInfoA
GetModuleHandleA
GetTickCount
Sleep
CancelIo
InterlockedExchange
SetEvent
ResetEvent
GetLastError
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
FreeLibrary
DeleteCriticalSection
LoadLibraryA
GetProcAddress
GetSystemInfo

user32

CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
wsprintfA

advapi32

OpenEventLogA
DeleteService
RegCreateKeyExA
RegSetValueExA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
RegOpenKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CloseServiceHandle
StartServiceA
CreateServiceA
OpenServiceA

msvcrt

_exit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
__CxxFrameHandler
??2@YAPAXI@Z
_CxxThrowException
rand
sprintf
srand
time
strrchr
malloc
puts
realloc
localtime
atoi
exit
strncmp
_except_handler3
_beginthreadex
calloc
free
??1type_info@@UAE@XZ
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr

ws2_32

setsockopt
htons
gethostbyname
WSAIoctl
select
recv
closesocket
send
inet_addr
connect
sendto
WSASocketA
htonl
getsockname
WSACleanup
WSAStartup
socket

Sections

.Buffer
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Socket
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.DDos
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Kernel
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Manager
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

eb16ecd01f171b0920c0216f07f889c8

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

ws2_32

Sections

.Buffer Size: 1024B - Virtual size: 960B

.Socket Size: 2KB - Virtual size: 2KB

.text Size: 30KB - Virtual size: 29KB

.DDos Size: 10KB - Virtual size: 9KB

.Kernel Size: 1024B - Virtual size: 960B

.Manager Size: 512B - Virtual size: 128B

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 8KB - Virtual size: 10KB

.Buffer
Size: 1024B - Virtual size: 960B

.Socket
Size: 2KB - Virtual size: 2KB

.text
Size: 30KB - Virtual size: 29KB

.DDos
Size: 10KB - Virtual size: 9KB

.Kernel
Size: 1024B - Virtual size: 960B

.Manager
Size: 512B - Virtual size: 128B

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 8KB - Virtual size: 10KB