gh0strat | 3e2080260355f0d4344abadf5065c58415f39e17a34603f5c4adcc4b11ff7122

Sharing

Copy URL Twitter E-mail

General

Target

3e2080260355f0d4344abadf5065c58415f39e17a34603f5c4adcc4b11ff7122
Size

152KB
MD5

b01b0f5fd3e210ef8bc7b161646e94d0
SHA1

26f4174b75b170fc8c97672bada1c478aa6ee9a1
SHA256

3e2080260355f0d4344abadf5065c58415f39e17a34603f5c4adcc4b11ff7122
SHA512

6ad311af0903d660500b292442841c2cb2ccd781bdc6b20e800aab7702ebee070437e5674e9ddb828406d957110bbbc9f100e2f7eba93eb3e1e44c71b3b32c35
SSDEEP

3072:rbKbnAeTjLpjtUWvgFcZAN3Ys29xK7dl97bTBftZaO0AZgjhV:3KbHVCWvoMZgLBbTBlMO0AG

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

3e2080260355f0d4344abadf5065c58415f39e17a34603f5c4adcc4b11ff7122
.dll windows x86

881790f5ee42811788ed33e8dd1f6dec

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
lstrlenA
FreeLibrary
GetProcAddress
WideCharToMultiByte
lstrcpyA
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetVersionExA
lstrcmpiA
CloseHandle
ExpandEnvironmentStringsA
lstrcatA
GetModuleHandleA
GetTickCount
ExitProcess
GetSystemDirectoryA
Sleep
GetExitCodeProcess
GetLastError
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
GetShortPathNameA
HeapAlloc
LocalFree
LocalAlloc
VirtualQuery
GetCurrentProcessId
GetCurrentThreadId
VirtualAlloc
GetFileAttributesExA
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
GetModuleFileNameA
LocalSize
LocalReAlloc
GetCurrentProcess
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
InterlockedExchange
GlobalFree
GlobalAlloc
InitializeCriticalSection
VirtualFree
LeaveCriticalSection
GetSystemInfo
GetProcessTimes
GlobalMemoryStatusEx
GetTempFileNameA
DeleteFileA
RemoveDirectoryA
ExitThread
IsBadReadPtr
IsBadStringPtrW
RaiseException
LoadLibraryA

user32

MessageBoxA
CloseWindowStation
GetCursorInfo
DestroyCursor
LoadCursorA
wvsprintfA
EnableWindow
ShowWindow
GetWindow
GetClassNameA
DestroyWindow
wsprintfA
CreateWindowExA

msvcrt

_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_memicmp
_strupr
_wcsicmp
_stricmp
_strlwr
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
__CxxFrameHandler
strncpy
free
malloc
strchr
strncat
wcslen
strstr
realloc
rand
srand
_ftol
wcsrchr
memmove
ceil
strrchr
_beginthreadex
atoi
strtol
wcstombs
_CxxThrowException

Exports

Exports

VidBitBlt
VidBufferToScreenBlt
VidCleanUp
VidDisplayString
VidDisplayStringXY
VidInitialize
VidResetDisplay
VidScreenToBufferBlt
VidSetScrollRegion
VidSetTextColor

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

881790f5ee42811788ed33e8dd1f6dec

Headers

File Characteristics

Imports

kernel32

user32

msvcrt

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 99KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 99KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB