gh0strat | a67f4ab203c3368d8857c9dca5a04b65c9c2c20ad58ba89d963ab126e76cdf1e | Triage

Sharing

General

Target

a67f4ab203c3368d8857c9dca5a04b65c9c2c20ad58ba89d963ab126e76cdf1e
Size

150KB
MD5

798992e92e10848758f8bec493256d3f
SHA1

a238d91d6078cd0878f88cbe222b0f21f46b21bd
SHA256

a67f4ab203c3368d8857c9dca5a04b65c9c2c20ad58ba89d963ab126e76cdf1e
SHA512

8c83515bd7912cec4c8a62300bc4d51ed330f977c1ccaf341150d79c8e5364c71f3b9ed98af24984ff63601d2588fc5b7d9f92f5b115c0a4a04616fd58433471
SSDEEP

3072:UklsT7O5ir+mKx8nw6CasHs26mwyMyjDm8e8k2gsQ0z:UkOTy4hCasHzPNjSR8k2X7

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

a67f4ab203c3368d8857c9dca5a04b65c9c2c20ad58ba89d963ab126e76cdf1e
.exe windows x86

dcb49470eb673cc02ec44f68493ca96d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
FreeResource
Sleep
WriteFile
CreateFileA
DeleteFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
WaitForSingleObject
CreateEventA
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
GetTickCount
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
GetModuleHandleA

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__getmainargs
_acmdln
exit
_exit
srand
rand
sprintf
_XcptFilter

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ