gh0strat | 5f9674a0f2e531fe1ea3f878bb256aaf6e8967b543e759498b2f3dd85bd32de4 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5f9674a0f2e531fe1ea3f878bb256aaf6e8967b543e759498b2f3dd85bd32de4
Size

172KB
MD5

4486c263a4ae1620893e74db8bf32262
SHA1

d5bc8a0324c195575ed14d52983c2da2b6876286
SHA256

5f9674a0f2e531fe1ea3f878bb256aaf6e8967b543e759498b2f3dd85bd32de4
SHA512

636fe6c701d53248ae79e1e6df297f16cbe071d9a0eb803aa9db746549f1c4acf4425c8cb0db153a7f6d4652475a3d500a170ace6fd327ed055de6ab185e61e6
SSDEEP

3072:bX8gvoZhG+8RiRnvth6y47VFRg6rb1Zb/aQfZ6eiPeqovqw:bX8JZhXZ6yShltZbCVheqoi

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

5f9674a0f2e531fe1ea3f878bb256aaf6e8967b543e759498b2f3dd85bd32de4
.exe windows x86

77837203d9da0db97fcca524f441b8d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
SetFilePointer
lstrlenA
CloseHandle
FreeResource
DeleteFileA
SizeofResource
LockResource
FindResourceA
GetModuleFileNameA
GetEnvironmentVariableA
WaitForSingleObject
CreateEventA
MoveFileExA
ExitProcess
GetModuleHandleA
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
GetStartupInfoA
FreeLibrary

msvcrt

_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
exit
_exit
srand
rand
sprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
_XcptFilter

Sections

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE