Behavioral task
behavioral1
Sample
6c28569e03bfbb5d04a03de6721404b8b7a1e9ddda6702d703d0a163f4b80f2d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6c28569e03bfbb5d04a03de6721404b8b7a1e9ddda6702d703d0a163f4b80f2d.exe
Resource
win10v2004-20220812-en
General
-
Target
6c28569e03bfbb5d04a03de6721404b8b7a1e9ddda6702d703d0a163f4b80f2d
-
Size
136KB
-
MD5
5f90b543486d17a4e0c652aaaa781cdb
-
SHA1
81ee474feb72659f4a9e0a9dbbb49ecc33d3843f
-
SHA256
6c28569e03bfbb5d04a03de6721404b8b7a1e9ddda6702d703d0a163f4b80f2d
-
SHA512
990557ad23e482ff816f6f73c1ef7f41df3788ceb60905f1f1996fc3cb48ca22e47964210366692eea5507bb2a7e3ef0d55f3ce70863a29d5e24d44833759398
-
SSDEEP
3072:Kx6D3iS+pMPWG7FKtyzMdOqydOq8L+k86yOPEtX5L:K8iKDI8bdO5zjPI5
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
6c28569e03bfbb5d04a03de6721404b8b7a1e9ddda6702d703d0a163f4b80f2d.exe windows x86
918b85569f3161e7746acf724923b0a0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
DeviceIoControl
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExA
OpenEventA
SetErrorMode
CreateMutexA
LocalSize
TerminateProcess
OpenProcess
GetCurrentProcess
GetCurrentThreadId
FlushFileBuffers
HeapAlloc
WriteFile
SetStdHandle
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapFree
WaitForSingleObject
CreateEventA
ExitProcess
TerminateThread
CreateThread
Sleep
lstrcatA
SetFilePointer
ReadFile
GetFileSize
FindFirstFileA
FindNextFileA
LocalFree
FindClose
GetDriveTypeA
GetProcAddress
lstrlenA
lstrcpyA
CreateDirectoryA
GetLastError
DeleteFileA
CancelIo
InterlockedExchange
SetEvent
CloseHandle
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
LoadLibraryA
HeapSize
InitializeCriticalSection
IsBadWritePtr
HeapReAlloc
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetModuleFileNameA
SetLastError
TlsAlloc
GetModuleHandleA
RaiseException
GetVersion
GetCommandLineA
ExitThread
TlsGetValue
TlsSetValue
RtlUnwind
user32
LoadCursorA
EnumWindows
DestroyCursor
BlockInput
SystemParametersInfoA
keybd_event
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
GetWindowTextA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
GetWindowThreadProcessId
wsprintfA
mouse_event
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
IsWindowVisible
gdi32
GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
advapi32
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
RegQueryValueA
shell32
SHGetFileInfoA
ws2_32
select
closesocket
send
ioctlsocket
__WSAFDIsSet
recv
socket
getsockname
getpeername
WSACleanup
gethostbyname
htons
connect
inet_addr
WSAStartup
wininet
InternetReadFile
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
psapi
EnumProcessModules
GetModuleFileNameExA
Sections
.text Size: 92KB - Virtual size: 90KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ