gh0strat | 9f9df1f5db18cf55d6e37602ed344f288f5634e112030c64f92e99de2fcac423

Sharing

Copy URL

Twitter E-mail

General

Target

9f9df1f5db18cf55d6e37602ed344f288f5634e112030c64f92e99de2fcac423
Size

264KB
MD5

c95cae800affa444ef8903281b1505b0
SHA1

02be31636a0b9cfbf7f96dcc515ac8e247bd3386
SHA256

9f9df1f5db18cf55d6e37602ed344f288f5634e112030c64f92e99de2fcac423
SHA512

42167b5a6bf4db41926f6b2d3cfbf4f3cc7dae963173c51b57decc9aeb4fbc04e6692023658da7c622612842bc2d3edcf106d981c0c7bf2789dc0b4af69e8c06
SSDEEP

3072:k1wPuBQf8aow8Z4LrmM0M5qz0CKFLwTYIttW6YFLwTYIttW6YFLwTYIttW6auf:kOP9odGm5qqz0CKZwC6YZwC6YZwC6h

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

9f9df1f5db18cf55d6e37602ed344f288f5634e112030c64f92e99de2fcac423
.dll windows x86

9677f4ab866d928eea0e77c3db0326e0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventA
CloseHandle
TerminateThread
WaitForSingleObject
SetEvent
ResumeThread
CreateThread
GetProcAddress
LoadLibraryA
GetModuleHandleA
FreeLibrary
GetPrivateProfileStringA
lstrcatA
GetLastError
RaiseException
InterlockedExchange
LocalAlloc

msvcrt

strstr
_beginthreadex
calloc
realloc
_initterm
_adjust_fdiv
strncat
_errno
strchr
strncmp
memmove
malloc
free
_CxxThrowException
_ftol
??1type_info@@UAE@XZ
ceil
__CxxFrameHandler
printf
??3@YAXPAX@Z
??2@YAPAXI@Z
_except_handler3
_strnicmp

msvcp60

?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

Exports

Exports

GetDllClassObject

Sections

.text
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 148KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9677f4ab866d928eea0e77c3db0326e0

Headers

File Characteristics

Imports

kernel32

msvcrt

msvcp60

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 76KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 12KB - Virtual size: 13KB

.rsrc Size: 148KB - Virtual size: 145KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 80KB - Virtual size: 76KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 148KB - Virtual size: 145KB

.reloc
Size: 8KB - Virtual size: 7KB