gh0strat | edd27909a8abaa7f70e525eb7118c2bc31b95528d61db4e25c6ffdc393f45a93

Sharing

Copy URL

Twitter E-mail

General

Target

edd27909a8abaa7f70e525eb7118c2bc31b95528d61db4e25c6ffdc393f45a93
Size

52KB
MD5

b6d08e8cac0fcd37d20f901951287055
SHA1

29c3aa3d78b7d2636e6af9f2b6865a76159e1ddb
SHA256

edd27909a8abaa7f70e525eb7118c2bc31b95528d61db4e25c6ffdc393f45a93
SHA512

c902fef8dd3c38133894366af411a7256f40e96a9ed55dd3dafa76c51b6388c64001015ebb58b8d1d802a454a06cd920d7468afe8cdc6550c03e03c95a774f49
SSDEEP

768:Ce6VQPN2gDGcVwcZ4nGc6x3hfWf/5fLUKOjTk7t29pxPYzkFV:b6OPtWc3cwWZfLUKOjTkZckzA

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

edd27909a8abaa7f70e525eb7118c2bc31b95528d61db4e25c6ffdc393f45a93
.dll windows x86

1c1655809c389d64dfcfdaa941dc5072

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
WriteFile
LocalAlloc
PeekNamedPipe
GetTickCount
GetVersionExA
ReleaseMutex
OpenEventA
SetErrorMode
FreeConsole
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
MoveFileExA
MoveFileA
TerminateThread
GetSystemDirectoryA
GetFileAttributesA
OpenProcess
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcatA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
LocalFree
SetLastError
CreateFileA
ReadFile
InitializeCriticalSection
lstrlenA
DeleteFileA
Sleep
CancelIo
InterlockedExchange
SetEvent
lstrcpyA
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
WaitForMultipleObjects

user32

OpenWindowStationA
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
wsprintfA
SetProcessWindowStation

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegEnumValueA
RegEnumKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyExA

shlwapi

SHDeleteKeyA

msvcrt

_initterm
_strnicmp
_adjust_fdiv
_strcmpi
??1type_info@@UAE@XZ
free
calloc
_beginthreadex
wcstombs
??3@YAXPAX@Z
memmove
ceil
_ftol
__CxxFrameHandler
??2@YAPAXI@Z
_CxxThrowException
_except_handler3
strncpy
strncat
strchr
malloc

ws2_32

setsockopt
closesocket
select
ntohs
gethostname
getsockname
connect
socket
gethostbyname
htons
send
WSAIoctl
WSACleanup
WSAStartup
recv

avicap32

capGetDriverDescriptionA

Exports

Exports

Rool
ServiceMain
whm

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c1655809c389d64dfcfdaa941dc5072

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shlwapi

msvcrt

ws2_32

avicap32

Exports

Exports

Sections

.text Size: 42KB - Virtual size: 42KB

.data Size: 6KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 960B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 42KB - Virtual size: 42KB

.data
Size: 6KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 2KB - Virtual size: 1KB