gh0strat | 8ff90d95127c8c4aa5de88b496091a96e1bbf73117d7f897f57f0173bc484d2a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8ff90d95127c8c4aa5de88b496091a96e1bbf73117d7f897f57f0173bc484d2a
Size

136KB
MD5

232a5c11b1ea109647707bde1d2e3490
SHA1

437e21c50c3b39bed140fe4eb029268a815827bb
SHA256

8ff90d95127c8c4aa5de88b496091a96e1bbf73117d7f897f57f0173bc484d2a
SHA512

5a596d6bb27ba39ee65f7b8511bf6af44e72ad427964b81adbb307d9a796190ec6add70e13979a2dc2c6d509a1f443ef8421c3cbc517648e82c941ea108dc75f
SSDEEP

3072:RZkoplKW5Y06F194zyfZnRxSSj3vhX7SMX:RXi2qn77zvhX7zX

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

8ff90d95127c8c4aa5de88b496091a96e1bbf73117d7f897f57f0173bc484d2a
.exe windows x86

733ac464bea7e3cf6b2ead7204fcb38b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
lstrcmpiA
CreateToolhelp32Snapshot
GetTickCount
ExitProcess
CloseHandle
lstrlenA
CreateFileA
ReadFile
GetProcAddress
GetModuleHandleA
MoveFileExA
DeleteFileA
WritePrivateProfileStringA
Sleep
GetLastError
CreateEventA
GetCommandLineA
CreateThread
SetFilePointer
FreeLibrary
RaiseException
InterlockedExchange
LocalAlloc
GetStartupInfoA

advapi32

CloseServiceHandle

msvcrt

strtok
strstr
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
free
??3@YAXPAX@Z
rand
??2@YAPAXI@Z
_strcmpi

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ