gh0strat | 8958e67beb17dcec3b21222737f9592576009a7563e7cd758eed9a53dfc42424

Sharing

Copy URL Twitter E-mail

General

Target

8958e67beb17dcec3b21222737f9592576009a7563e7cd758eed9a53dfc42424
Size

512KB
MD5

86c86262c8992537c81da0415d6de932
SHA1

dcdb21c95a30ad23410972d702c7e97cedce2bb3
SHA256

8958e67beb17dcec3b21222737f9592576009a7563e7cd758eed9a53dfc42424
SHA512

826f109ae10f9e9c5047c4044fd88f56cd1b202e49d121a4fbb2a5f7d4bd6795be08e43c6f0bbe2492da10cc9e47727c1e3f9419736ae48e417dd08039b5e343
SSDEEP

12288:t+JlAghv3r+TsP5BtW/J3ZHP3ieHsdM5W:elAghv3r+TsP5B6JJHaEuM5W

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

8958e67beb17dcec3b21222737f9592576009a7563e7cd758eed9a53dfc42424
.exe windows x86

304591723bbc991d64fa9eb7ba52bf23

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

avicap32

capGetDriverDescriptionA

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

kernel32

SetThreadPriority
SetPriorityClass
GetThreadPriority
GetCurrentThread
GetPriorityClass
GetCurrentProcess
GlobalMemoryStatus
GetTickCount
GetSystemInfo
GetModuleFileNameA
LCMapStringW
QueryPerformanceFrequency
SetFilePointer
FlushFileBuffers
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
InterlockedIncrement
InterlockedDecrement
CloseHandle
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
QueryPerformanceCounter
GlobalAlloc
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
LCMapStringA
Sleep
FindFirstFileA
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDriveTypeA
lstrlenA
GetFileAttributesA
CreateDirectoryA
InterlockedExchange
lstrcpyA
ResetEvent
WideCharToMultiByte
LeaveCriticalSection
LoadLibraryA
GetProcAddress
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
SetLastError
TlsAlloc
RaiseException
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
ExitThread
TlsGetValue
TlsSetValue
GetCurrentThreadId
CreateThread
GetLastError
TerminateProcess
ExitProcess
RtlUnwind

user32

SetCapture
WindowFromPoint
CreateWindowExA
CloseWindow
GetClientRect
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
MapVirtualKeyA
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
keybd_event
SendMessageA
CharNextA
wsprintfA
LoadCursorA
DestroyCursor
BlockInput
SetRect
SystemParametersInfoA
GetThreadDesktop
OpenDesktopA
PostMessageA

gdi32

GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap

advapi32

RegQueryValueA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegCloseKey

shell32

SHGetFileInfoA

ole32

CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString

ws2_32

WSAStartup
WSAIoctl
setsockopt
connect
htons
gethostbyname
socket
ntohs
recv
listen
select
send
inet_ntoa
inet_addr
getsockname
bind
getpeername
accept
gethostname
__WSAFDIsSet
recvfrom
sendto
closesocket
WSACleanup

Sections

.text
Size: 424KB - Virtual size: 422KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 488KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

304591723bbc991d64fa9eb7ba52bf23

Headers

File Characteristics

Imports

avicap32

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

ws2_32

Sections

.text Size: 424KB - Virtual size: 422KB

.rodata Size: 12KB - Virtual size: 10KB

.rdata Size: 44KB - Virtual size: 40KB

.data Size: 24KB - Virtual size: 488KB

.rsrc Size: 4KB - Virtual size: 16B

.text
Size: 424KB - Virtual size: 422KB

.rodata
Size: 12KB - Virtual size: 10KB

.rdata
Size: 44KB - Virtual size: 40KB

.data
Size: 24KB - Virtual size: 488KB

.rsrc
Size: 4KB - Virtual size: 16B