gh0strat | 770f14eb92dcbd0ebd951bd8be9a93d089719a5623a3475dce879211c5fd1b09

General

Target

770f14eb92dcbd0ebd951bd8be9a93d089719a5623a3475dce879211c5fd1b09
Size

148KB
MD5

6ee8626282d2525845edb4b785aad92d
SHA1

546be8ef085e06002547cbb02eaecbed8a3a6e57
SHA256

770f14eb92dcbd0ebd951bd8be9a93d089719a5623a3475dce879211c5fd1b09
SHA512

ac2ff9c40ebb1b2dd06e889eafbb600983fb7f08200f0da5db0602442c8a93d6cf551e990e3136609fb9f47cb7e5bbe37f229ee74553cb65e75cc2f32f273554
SSDEEP

3072:dk1eU92OECOKkVChROnQktuH9q1hf6g5rZCgTBftYEFEu:dwFoOEnvVCWnQkudgN6BgTBlY0Eu

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

770f14eb92dcbd0ebd951bd8be9a93d089719a5623a3475dce879211c5fd1b09
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

AuthzAccessCheck
AuthzAddSidsToContext
AuthzCachedAccessCheck
AuthzEnumerateSecurityEventSources
AuthzFreeAuditEvent
AuthzFreeContext
AuthzFreeHandle
AuthzFreeResourceManager
AuthzGetInformationFromContext
AuthzInitializeContextFromAuthzContext
AuthzInitializeContextFromSid
AuthzInitializeContextFromToken
AuthzInitializeObjectAccessAuditEvent
AuthzInitializeObjectAccessAuditEvent2
AuthzInitializeResourceManager
AuthzInstallSecurityEventSource
AuthzOpenObjectAudit
AuthzRegisterSecurityEventSource
AuthzReportSecurityEvent
AuthzReportSecurityEventFromParams
AuthzUninstallSecurityEventSource
AuthzUnregisterSecurityEventSource
AuthziAllocateAuditParams
AuthziFreeAuditEventType
AuthziFreeAuditParams
AuthziFreeAuditQueue
AuthziInitializeAuditEvent
AuthziInitializeAuditEventType
AuthziInitializeAuditParams
AuthziInitializeAuditParamsFromArray
AuthziInitializeAuditParamsWithRM
AuthziInitializeAuditQueue
AuthziInitializeContextFromSid
AuthziLogAuditEvent
AuthziModifyAuditEvent
AuthziModifyAuditEvent2
AuthziModifyAuditEventType
AuthziModifyAuditQueue
AuthziQueryAuditPolicy

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 95KB

.rdata Size: 28KB - Virtual size: 26KB

.data Size: 12KB - Virtual size: 13KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 96KB - Virtual size: 95KB

.rdata
Size: 28KB - Virtual size: 26KB

.data
Size: 12KB - Virtual size: 13KB

.reloc
Size: 8KB - Virtual size: 6KB