gh0strat | ea5d4d3b50fb5fabb7ba3226b483bd04a0b842b02391dfa8e4d2475b3673d786

Sharing

Copy URL Twitter E-mail

General

Target

ea5d4d3b50fb5fabb7ba3226b483bd04a0b842b02391dfa8e4d2475b3673d786
Size

39KB
MD5

fe153f7dfef97bb9db4cda82c1dcd34f
SHA1

232495cfb2323c0024cf344456e25aac76f11346
SHA256

ea5d4d3b50fb5fabb7ba3226b483bd04a0b842b02391dfa8e4d2475b3673d786
SHA512

a9f9d93fcab2f8ea5e5d9015aa8d50390a1d1d248dc9546dadf1642184554aff751bbfb775f08aecfed6f58fd984426c5bfe2e510795e5aecbd564a0143c4348
SSDEEP

768:VbhWGFdoRn/zc1YoMBwS/CPJ0lw5p6Zlp2WWv82ftSFOjhrTD:VbhWsWR/yjiwXalw5pClpRT5yrT

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

ea5d4d3b50fb5fabb7ba3226b483bd04a0b842b02391dfa8e4d2475b3673d786
.dll windows x86

a1e39b6b86813e37b81e9a2c3e588569

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileA
RemoveDirectoryA
LocalAlloc
GetFileSize
CreateFileA
ReadFile
WriteFile
SetFilePointer
MoveFileA
GetTempPathA
GetModuleFileNameA
SetLastError
TerminateThread
GetSystemDirectoryA
LocalReAlloc
PeekNamedPipe
GetVersionExA
GetTickCount
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
LocalSize
Process32First
lstrcmpiA
GetCurrentThreadId
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetDriveTypeA
lstrcatA
lstrlenA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
CancelIo
InterlockedExchange
SetEvent
WaitForSingleObject
lstrcpyA
ResetEvent
Sleep
FreeLibrary
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
LoadLibraryA
GetProcAddress
DisconnectNamedPipe

user32

CharNextA
wsprintfA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
IsWindowVisible
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation

advapi32

RegOpenKeyA
RegQueryValueExA
RegDeleteKeyA
RegQueryValueA
RegCloseKey
RegOpenKeyExA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus

msvcrt

_adjust_fdiv
_strnset
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
__CxxFrameHandler
_CxxThrowException
??2@YAPAXI@Z
free
malloc
_except_handler3
strrchr
strncat
strchr
realloc
atoi
wcstombs
strncpy
_beginthreadex
??1type_info@@UAE@XZ
_initterm

ws2_32

closesocket
socket
select
htons
connect
WSAIoctl
recv
gethostname
gethostbyname
WSAStartup
getsockname

msvcp60

?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

wininet

InternetCloseHandle

Exports

Exports

?_Xlen@std@@YAXXZ
?_Xran@std@@YAXXZ
CH
JustforFun1
JustforFun2
JustforFun3
ServiceMain

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a1e39b6b86813e37b81e9a2c3e588569

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

ws2_32

msvcp60

wininet

Exports

Exports

Sections

.text Size: 34KB - Virtual size: 34KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 34KB - Virtual size: 34KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB