gh0strat | a956accb8b22bd700b0b27f22b297e6d8964223ba922eed67f5434ac8aab9df4

Sharing

Copy URL Twitter E-mail

General

Target

a956accb8b22bd700b0b27f22b297e6d8964223ba922eed67f5434ac8aab9df4
Size

114KB
MD5

0b78810e650dbcd87ace5c35cb7c78f0
SHA1

c6d7abf3baa8ac310c3ed91f8a004dc8a5a79923
SHA256

a956accb8b22bd700b0b27f22b297e6d8964223ba922eed67f5434ac8aab9df4
SHA512

099dfb1d4323ca1df710935319345fbbd34bd8648f8942aa8f4a5e635383fb2656b9dbae76754d9beb373e4bbb6fd1a573c78ddaf4ed0fa631b424fd00597831
SSDEEP

3072:rrd/ZJ1Rn0M6dXnEha0Ey1OavHM/CnJhL:rhb1Rn0FtEIfy1OavsOJhL

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

a956accb8b22bd700b0b27f22b297e6d8964223ba922eed67f5434ac8aab9df4
.exe windows x86

619af20427ddbceeff4257698efb57e6

Code Sign

3a:30:d8:f8:0d:74:80:06:2e:bd:a6:f6:f8:fd:79:80:aa:91:0c:e6
Signer

Actual PE Digest

3a:30:d8:f8:0d:74:80:06:2e:bd:a6:f6:f8:fd:79:80:aa:91:0c:e6

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

NO CERTIFICATE

01/01/0001, 00:00
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
LoadLibraryA
OutputDebugStringA
ExitProcess
SetFileAttributesA
SizeofResource
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
LoadResource
FindResourceA
lstrcatA
GetTempPathA
GetFileAttributesA
lstrlenA
SetUnhandledExceptionFilter
GetModuleHandleW
GetStartupInfoW

msvcrt.dll.

_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_mbsstr
__CxxFrameHandler

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 336B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 976B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 816B - Virtual size: 804B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 736B - Virtual size: 730B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

619af20427ddbceeff4257698efb57e6

Code Sign

3a:30:d8:f8:0d:74:80:06:2e:bd:a6:f6:f8:fd:79:80:aa:91:0c:e6Signer

Signature Validations

Verification

01/01/0001, 00:00 Valid: false

Headers

File Characteristics

Imports

kernel32

msvcrt.dll.

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 336B - Virtual size: 336B

.data Size: 976B - Virtual size: 976B

INIT Size: 816B - Virtual size: 804B

.rsrc Size: 104KB - Virtual size: 104KB

.reloc Size: 736B - Virtual size: 730B

3a:30:d8:f8:0d:74:80:06:2e:bd:a6:f6:f8:fd:79:80:aa:91:0c:e6
Signer

01/01/0001, 00:00
Valid: false

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 336B - Virtual size: 336B

.data
Size: 976B - Virtual size: 976B

INIT
Size: 816B - Virtual size: 804B

.rsrc
Size: 104KB - Virtual size: 104KB

.reloc
Size: 736B - Virtual size: 730B