gh0strat | e68d85a33eb5e01a944d2a16824a91163ac5ba22670e9b34d66e6f6a2556af1b

Sharing

Copy URL Twitter E-mail

General

Target

e68d85a33eb5e01a944d2a16824a91163ac5ba22670e9b34d66e6f6a2556af1b
Size

148KB
MD5

77978735eeb80fada85b3f3a2cec30f5
SHA1

0842a76e43004f1e2760880bfdd1734e56cf72d0
SHA256

e68d85a33eb5e01a944d2a16824a91163ac5ba22670e9b34d66e6f6a2556af1b
SHA512

e6eae8682c0acc24498a19d72e4ee6c5526a43f13a34c42b9cc42b854a14750d4b266506ab6f350adc253297696410d8e7d0f1bfd007643b17115b2cc6d09620
SSDEEP

3072:RJKTS2eCaf+Tob4Vm1bKFSGDQIKvbBUWiFqX56WdIjcVw:vK3j+mosf10RbGfFS56Wd0c

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

e68d85a33eb5e01a944d2a16824a91163ac5ba22670e9b34d66e6f6a2556af1b
.dll windows x86

cbabb92985653868602aa0dcd9c53e96

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
UnmapViewOfFile
GlobalFree
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
CreateFileMappingA
GetCurrentProcess
ReleaseMutex
SetErrorMode
CreateMutexA
GetTickCount
OutputDebugStringA
GetTempPathA
lstrcmpiA
GetCurrentThreadId
GetProcessHeap
HeapFree
WaitForMultipleObjects
MapViewOfFile
SetLastError
GetModuleFileNameA
MoveFileA
WriteFile
GetLocalTime
CreateFileA
GetFileSize
RemoveDirectoryA
FindFirstFileA
FindNextFileA
FindClose
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
lstrcatA
CreateProcessA
CreateDirectoryA
GetLastError
CreateEventA
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
GetFileAttributesA
FreeLibrary
Sleep
VirtualAlloc
LeaveCriticalSection
VirtualFree
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
LoadLibraryA
GetProcAddress
lstrlenA
CreateRemoteThread
Beep
DeviceIoControl
ReadFile
GetVersion
CloseHandle
GlobalMemoryStatusEx

user32

LoadCursorA
SystemParametersInfoA
SetCapture
WindowFromPoint
SetCursorPos
CloseClipboard
SetClipboardData
EmptyClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
CallNextHookEx
GetDesktopWindow
ReleaseDC
GetKeyNameTextA
GetActiveWindow
GetWindowTextA
SwapMouseButton
SendMessageA
GetForegroundWindow
GetWindowRect
MoveWindow
DispatchMessageA
TranslateMessage
GetMessageA
CharNextA
FindWindowA
ShowWindow
MessageBoxA
GetCursorPos
SetProcessWindowStation
GetProcessWindowStation
EnumWindows
CloseDesktop
GetUserObjectInformationA
PostMessageA
CreateWindowExA
CloseWindow
IsWindow

gdi32

BitBlt
DeleteObject
CreateDIBSection
SelectObject
CreateCompatibleBitmap

advapi32

FreeSid
RegCloseKey
RegOpenKeyExA
OpenProcessToken
IsValidSid
LookupAccountNameA
LsaOpenPolicy
LsaFreeMemory
QueryServiceStatus
OpenSCManagerA
RegCreateKeyA
RegOpenKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
LookupPrivilegeValueA
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegQueryInfoKeyA
EnumServicesStatusA
ChangeServiceConfigA
StartServiceA
DuplicateTokenEx
RegQueryValueExA

shell32

SHGetFileInfoA

shlwapi

SHDeleteKeyA

msvcrt

_strnset
_strrev
_stricmp
_strnicmp
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
_beginthreadex
wcstombs
atol
realloc
strncat
_CxxThrowException
wcscpy
_errno
strchr
strncmp
atoi
strrchr
malloc
free
_except_handler3
strncpy
sprintf
puts
putchar
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
memmove
ceil
_ftol
strstr
rand
_strcmpi

winmm

waveInUnprepareHeader
waveOutUnprepareHeader
waveOutClose
waveInReset
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveOutWrite
waveInStart
waveInClose
waveOutPrepareHeader
waveOutOpen
waveOutGetNumDevs
mciSendStringA
waveInStop

ws2_32

ntohs
socket
recv
htons
connect
setsockopt
WSACleanup
WSAStartup
closesocket
select
send
inet_addr
sendto
gethostname
__WSAFDIsSet
recvfrom
listen
accept
getpeername
bind
getsockname
inet_ntoa
gethostbyname
htonl

userenv

GetUserProfileDirectoryA
GetProfilesDirectoryA

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

netapi32

NetUserAdd
NetLocalGroupAddMembers

imm32

ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA

msvfw32

ICSeqCompressFrameEnd
ICCompressorFree
ICOpen
ICSendMessage
ICSeqCompressFrameStart

wtsapi32

WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationA

psapi

EnumProcessModules

Exports

Exports

EASTNOD
aoxiang
okokokokop

Sections

.text
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cbabb92985653868602aa0dcd9c53e96

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

msvcrt

winmm

ws2_32

userenv

msvcp60

netapi32

imm32

msvfw32

wtsapi32

psapi

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 100KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 1016B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 104KB - Virtual size: 100KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1016B

.reloc
Size: 8KB - Virtual size: 7KB