gh0strat | fd62092dd207bd615752c68b9baddf1c7cdacd2b894d1dd3d13311a6374dd326

Sharing

Copy URL Twitter E-mail

General

Target

fd62092dd207bd615752c68b9baddf1c7cdacd2b894d1dd3d13311a6374dd326
Size

96KB
MD5

e8e70fb4dff64954b59e21824131c8bc
SHA1

cb6219458392e575caa6c25da55fdfb402d02b60
SHA256

fd62092dd207bd615752c68b9baddf1c7cdacd2b894d1dd3d13311a6374dd326
SHA512

418bd36ca15d86a5345110205980012723168168e97b2afb3c09481b44b1454b5d818a0d7836ffc9b9595b7eed6630b2f5e2409872ce70a9c5ae8a7ef6ac2bbb
SSDEEP

1536:v/cb3x/+8mrg2WKuDUVGc7AzfTpp6TE80z1hYd/AAY94QQuiwP5UJe:HUsDlVGUATTT6TqBCd/U94QriG2Je

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

fd62092dd207bd615752c68b9baddf1c7cdacd2b894d1dd3d13311a6374dd326
.dll windows x86

a8b09411fcfd6e859cbf5d9b12f461d9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcsnicmp
_snprintf
_errno
strncpy
strncmp
sprintf
wcslen
wcsrchr
_except_handler3
wcscat
mbstowcs
wcscpy
wcsstr
wcstombs
strchr
atoi
malloc
realloc
_CxxThrowException
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
_strnicmp
wcschr
wcsncat
_beginthreadex
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
free
??2@YAPAXI@Z

kernel32

lstrcatW
GetCurrentThreadId
lstrcmpiW
GetCurrentProcess
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
TerminateProcess
LocalSize
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetWindowsDirectoryW
GetLocalTime
SetFilePointer
LoadLibraryA
MoveFileW
WriteFile
ReadFile
FreeLibrary
CreateFileW
GetFileSize
RemoveDirectoryW
CreateEventW
CloseHandle
TerminateThread
WaitForSingleObject
SetEvent
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetProcAddress
LoadLibraryW
ResetEvent
GetFileAttributesW
InterlockedExchange
Sleep
lstrlenW
MultiByteToWideChar
lstrcpyW
GetVersionExW
ReleaseMutex
OpenEventW
SetErrorMode
CreateMutexA
GetTickCount
SetUnhandledExceptionFilter
DeleteFileW
GetLastError
CreateDirectoryW
CreateProcessW
RaiseException
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileW
lstrcmpW
LocalReAlloc
LocalAlloc

msvcp60

?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEAAEPBG@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z

Exports

Exports

msdn

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a8b09411fcfd6e859cbf5d9b12f461d9

Headers

File Characteristics

Imports

msvcrt

kernel32

msvcp60

Exports

Exports

Sections

.text Size: 65KB - Virtual size: 65KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 9KB - Virtual size: 13KB

.rsrc Size: 1024B - Virtual size: 1008B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 65KB - Virtual size: 65KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 9KB - Virtual size: 13KB

.rsrc
Size: 1024B - Virtual size: 1008B

.reloc
Size: 6KB - Virtual size: 6KB