Behavioral task
behavioral1
Sample
9f0b5f630ad8095e3d918cf9831c608534d2b02ad9d3766a921aa6413de70449.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9f0b5f630ad8095e3d918cf9831c608534d2b02ad9d3766a921aa6413de70449.exe
Resource
win10v2004-20221111-en
General
-
Target
9f0b5f630ad8095e3d918cf9831c608534d2b02ad9d3766a921aa6413de70449
-
Size
67KB
-
MD5
21ea14badb09c78ad57ea3f85b3878fc
-
SHA1
689b0f68ca08ab801cbf83561e3a42b4bc3b1593
-
SHA256
9f0b5f630ad8095e3d918cf9831c608534d2b02ad9d3766a921aa6413de70449
-
SHA512
3066c059eeee18641382fda598af9a10e1277d483e28669cadc2ceb8b89253e96571feb6cc6a2250c4018bd48c05cd7224871f28814408834a08835c5398c581
-
SSDEEP
1536:Yf0gwpGFFz2g1NIq+1M/sYqjduimiqrinT16xnm8C18:YVpa1M/sYqjdLmcnZ6dm8C18
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
9f0b5f630ad8095e3d918cf9831c608534d2b02ad9d3766a921aa6413de70449.exe windows x86
fa990638f6a36215436e41fcbd9ecbbc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_beginthreadex
_access
sprintf
_except_handler3
free
realloc
malloc
??2@YAPAXI@Z
_CxxThrowException
__CxxFrameHandler
_ftol
memmove
??3@YAXPAX@Z
kernel32
GetStartupInfoA
GetModuleHandleA
CreateToolhelp32Snapshot
Process32First
Process32Next
lstrcmpiA
CopyFileA
SetFileAttributesA
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
Sleep
WaitForSingleObject
ResetEvent
lstrcpyA
SetEvent
InterlockedExchange
CancelIo
WriteFile
SetFilePointer
CreateFileA
GetFileSize
ReadFile
GetWindowsDirectoryA
GetFileAttributesA
CreateProcessA
lstrlenA
TerminateThread
lstrcatA
GetTickCount
GetLastError
GetCurrentProcess
HeapAlloc
GetProcessHeap
VirtualProtect
GetProcAddress
LoadLibraryA
IsBadReadPtr
HeapFree
FreeLibrary
GetDiskFreeSpaceExA
GetDriveTypeA
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExA
ExpandEnvironmentStringsA
FindFirstFileA
GetModuleFileNameA
ExitProcess
DeleteFileA
DuplicateHandle
OpenProcess
CreateDirectoryA
GetLocalTime
OpenEventA
CreateThread
WinExec
FindClose
user32
OpenInputDesktop
GetThreadDesktop
GetUserObjectInformationA
SetThreadDesktop
OpenDesktopA
PostThreadMessageA
GetInputState
GetMessageA
ExitWindowsEx
wsprintfA
CloseDesktop
advapi32
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CloseServiceHandle
StartServiceA
OpenServiceA
ChangeServiceConfig2A
LockServiceDatabase
CreateServiceA
shell32
ShellExecuteA
ws2_32
WSAStartup
WSACleanup
WSAIoctl
setsockopt
connect
htons
gethostbyname
socket
ntohs
recv
closesocket
select
send
gethostname
getsockname
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 25KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ