ServiceMain
Behavioral task
behavioral1
Sample
74a9dfcc73d0ef2ed1520516b4af2e5516512c809e18bf30229673f94d42384b.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
74a9dfcc73d0ef2ed1520516b4af2e5516512c809e18bf30229673f94d42384b.dll
Resource
win10v2004-20221111-en
General
-
Target
74a9dfcc73d0ef2ed1520516b4af2e5516512c809e18bf30229673f94d42384b
-
Size
109KB
-
MD5
4d9286e81f0677c4704442eb5f0e4e4d
-
SHA1
2d97d08698cd7c27ebdcee15fe3642c87cd9de46
-
SHA256
74a9dfcc73d0ef2ed1520516b4af2e5516512c809e18bf30229673f94d42384b
-
SHA512
aafe4868f541fdeb25fd28090d797503d9f24ab45f1edfde67709d98b517e45bf9d7008430b09a8d4ad4d2e167408789ff64f6b9ce59ee3eebbb74ab9e5445c4
-
SSDEEP
1536:H3VLgk0U5/py0P/rRjMVagBiPcsMRfC7EubK5vlg4AasWUjkdE:FLdpyWxMdBiPvMBC7EdlNAasnjkdE
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
74a9dfcc73d0ef2ed1520516b4af2e5516512c809e18bf30229673f94d42384b.dll windows x86
08bc1669838d914f481fe72e18f5b4c5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_wcsnicmp
_snprintf
_errno
sprintf
strncpy
strncmp
wcslen
wcsrchr
_except_handler3
free
fopen
fseek
fread
fwrite
fputc
fclose
wcscat
_wcsupr
mbstowcs
wcscpy
wcsstr
wcstombs
strchr
atoi
malloc
realloc
_CxxThrowException
strstr
_ftol
ceil
memmove
??3@YAXPAX@Z
__CxxFrameHandler
_strnicmp
wcschr
wcsncat
_beginthreadex
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
wcscmp
??2@YAPAXI@Z
kernel32
CreateMutexA
RaiseException
FreeLibrary
GetCurrentThreadId
GetProcAddress
OpenProcess
TerminateProcess
LocalSize
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetLocalTime
MoveFileW
WriteFile
SetFilePointer
ReadFile
CreateFileW
GetFileSize
RemoveDirectoryW
LocalAlloc
FindFirstFileW
LocalReAlloc
lstrcmpW
FindNextFileW
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessW
GetFileAttributesW
CreateDirectoryW
DeleteFileW
WideCharToMultiByte
GetProcessHeap
HeapAlloc
HeapFree
GetModuleFileNameW
GetLastError
GetSystemDirectoryW
CreateEventW
CloseHandle
TerminateThread
WaitForSingleObject
SetEvent
ResumeThread
CreateThread
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
ResetEvent
InterlockedExchange
GetTempPathW
CancelIo
Sleep
lstrlenW
MultiByteToWideChar
Process32NextW
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
lstrcpyW
GetVersionExW
lstrcatW
GetCurrentProcess
GetWindowsDirectoryW
ReleaseMutex
OpenEventW
SetErrorMode
LoadLibraryA
GetTickCount
SetUnhandledExceptionFilter
FreeConsole
CopyFileW
iphlpapi
AddIPAddress
GetInterfaceInfo
msvfw32
ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICOpen
ICSendMessage
ICSeqCompressFrameStart
ICSeqCompressFrame
msvcp60
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEAAEPBG@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
Exports
Exports
Sections
.text Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ