gh0strat | fba3fb51eb7831345b7275f5c224dbe03cfe3e386608b28dbeca78c52b623e0c | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fba3fb51eb7831345b7275f5c224dbe03cfe3e386608b28dbeca78c52b623e0c
Size

196KB
MD5

471927de0414479c51de66e25db95168
SHA1

b08d6b48d0372443f6dd5651c93b3f5a65ed7f82
SHA256

fba3fb51eb7831345b7275f5c224dbe03cfe3e386608b28dbeca78c52b623e0c
SHA512

ad1e99e98abd510deb3b8b60958885f81a9ca3a69139712c155b6a4cde1d2e78d1d406d0eb0fb453415b469f1bb3ba61e0c4966f8c03e21911d8d2980d8bea39
SSDEEP

3072:5pixrcYyNNBxIf58d6UuSMhXk22T94oz7vEEZzcEUJO7Ri+1:5YANBxIxh0u4TSg7vECzcX07Rp

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

fba3fb51eb7831345b7275f5c224dbe03cfe3e386608b28dbeca78c52b623e0c
.exe windows x86

7838ebd0b44918c38e8119626e7c981a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
WaitForSingleObject
SizeofResource
CreateEventA
LoadResource
GetModuleHandleA
CreateFileA
WriteFile
Sleep
LockResource
FreeResource
CloseHandle
LoadLibraryA
GetTickCount
GetProcAddress
GetStartupInfoA

user32

LoadIconA
RegisterClassA
LoadCursorA

gdi32

GetStockObject

advapi32

StartServiceA
RegOpenKeyA
RegSetValueExA
RegCloseKey
ControlService
OpenSCManagerA
RegCreateKeyExA

msvcrt

sprintf
rand
srand
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 191KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ