gh0strat | 306d4060247d49ddc78704afefd36353c540deefefef8e9ca6950f3a351635db | Triage

Sharing

Copy URL Twitter E-mail

General

Target

306d4060247d49ddc78704afefd36353c540deefefef8e9ca6950f3a351635db
Size

152KB
MD5

6bc4817d29cbc9817b27ff368fd35457
SHA1

5738030c883233332135d31c49f9c49f30d61c51
SHA256

306d4060247d49ddc78704afefd36353c540deefefef8e9ca6950f3a351635db
SHA512

24587b95443c7ab9371da0b858e836ef1967ef64fc436c68e5eeab075d6789e17ebd86b71be65f1746d1b98e1eb6adf4eb86316d6981efbae22510408d5305ee
SSDEEP

3072:VBtSf+yYmPD8IZr+PqbssYPx5OcTBfthHr5XnFPn:VBTyFZqyhYPbOcTBlhHrtndn

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

306d4060247d49ddc78704afefd36353c540deefefef8e9ca6950f3a351635db
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

NPAddConnection
NPAddConnectiOn3
NPCancelConnection
NPCloseEnum
NPEnumResource
NPGetCaps
NPGetConnection
NPGetResourceInformation
NPGetResourceParent

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ