gh0strat | 0ce39cb8009afc81243e6c76ee23e807ee35dda2a34c4152836dcc5f47c851a0

Sharing

Copy URL Twitter E-mail

General

Target

0ce39cb8009afc81243e6c76ee23e807ee35dda2a34c4152836dcc5f47c851a0
Size

96KB
MD5

0668cb7f0aec897bbc82db0fb269b4e0
SHA1

810b1815da61676c0c4e512c4e8b839a5abbf444
SHA256

0ce39cb8009afc81243e6c76ee23e807ee35dda2a34c4152836dcc5f47c851a0
SHA512

8104f9331d0e2c148ad62674dc9c73cce151866ef395e413a9c504730adccf335d348417e33bdb9cee484370d75c14f0d7cc6a428f883db65865c9ca142ac5e3
SSDEEP

1536:qNrl4FAIqmu9GQb6uQpu1cQ0Vf4YOliMadQm0lZgt:er+7qvbcu1j0N4YOXadQm0lZgt

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

0ce39cb8009afc81243e6c76ee23e807ee35dda2a34c4152836dcc5f47c851a0
.dll windows x86

0cc0c7d3f10b24b41977817e1d298fd6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_strnicmp
_stricmp
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
??3@YAXPAX@Z
strncat
exit
fopen
fseek
fwrite
fclose
_errno
strchr
strncpy
strncmp
sprintf
strrchr
_except_handler3
strtok
atoi
free
malloc
realloc
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
strstr
_ftol
ceil
memmove
_beginthreadex
_strlwr

ws2_32

inet_addr
__WSAFDIsSet
ioctlsocket
bind
accept
getsockname
gethostname
send
select
closesocket
recv
ntohs
socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
getpeername
inet_ntoa
sendto
recvfrom
WSAStartup
WSACleanup
listen

mfc42

ord1182
ord342
ord1253
ord1200
ord1168

kernel32

GlobalLock
GlobalUnlock
GlobalFree
OpenProcess
CreateToolhelp32Snapshot
Process32First
GlobalAlloc
GlobalSize
GetSystemDirectoryA
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
WaitForMultipleObjects
LocalSize
GetCurrentProcess
lstrcmpiA
GetCurrentThreadId
PeekNamedPipe
Process32Next
ExpandEnvironmentStringsA
CopyFileA
TerminateThread
MoveFileA
WriteFile
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent
lstrcpyA
SetEvent
InterlockedExchange
CancelIo
Sleep
lstrlenA
GetVersionExA
ReleaseMutex
GetTickCount
OpenEventA
SetErrorMode
CreateThread
DeleteFileA
GetLastError
CreateDirectoryA
GetFileAttributesA
CreateProcessA
lstrcatA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
TerminateProcess

user32

SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
SetRect
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
mouse_event
CloseDesktop
WindowFromPoint
SetCapture
MapVirtualKeyA
keybd_event
SendMessageA
SystemParametersInfoA
BlockInput
PostMessageA
DestroyCursor
LoadCursorA
CharNextA
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
wsprintfA
EnumWindows
ExitWindowsEx
GetCursorPos
GetCursorInfo
ReleaseDC
GetDesktopWindow
SetCursorPos
GetDC

gdi32

BitBlt
SelectObject
CreateCompatibleBitmap
DeleteObject
CreateCompatibleDC
CreateDIBSection
DeleteDC
GetDIBits

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegQueryValueA
RegOpenKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
RegEnumValueA
RegEnumKeyExA

shell32

SHGetFileInfoA

avicap32

capGetDriverDescriptionA

msvcp60

?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

psapi

GetModuleFileNameExA
EnumProcessModules

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0cc0c7d3f10b24b41977817e1d298fd6

Headers

File Characteristics

Imports

msvcrt

ws2_32

mfc42

kernel32

user32

gdi32

advapi32

shell32

avicap32

msvcp60

psapi

iphlpapi

Sections

.text Size: 64KB - Virtual size: 60KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 8KB - Virtual size: 7KB

.rsrc Size: 4KB - Virtual size: 808B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 64KB - Virtual size: 60KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 4KB - Virtual size: 808B

.reloc
Size: 4KB - Virtual size: 3KB