Behavioral task
behavioral1
Sample
e68977e1f60c3db2940cd44fa08cee6d3ad510f48cd1cda6e4e2e708a582abb1.exe
Resource
win7-20220812-en
General
-
Target
e68977e1f60c3db2940cd44fa08cee6d3ad510f48cd1cda6e4e2e708a582abb1
-
Size
219KB
-
MD5
a80cea44c3ad50c99a41d0d8ab29f5b6
-
SHA1
8948ee7ededab7201d05ec3bf0d2f9706ffde382
-
SHA256
e68977e1f60c3db2940cd44fa08cee6d3ad510f48cd1cda6e4e2e708a582abb1
-
SHA512
019dc87579193a7552a8cbae37c882a2604e56e4527885c24f78e74a66bb17c62b9a1482d04d17b65e7cfacd163a19bb5af874b75cbf504e5a67c8bf785b6b94
-
SSDEEP
6144:rgHN6PVwOP7bLtUw/8ysBW889+BjONFaJMDtCsAMjwN:rgwPVw+7lziAJPjs
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
e68977e1f60c3db2940cd44fa08cee6d3ad510f48cd1cda6e4e2e708a582abb1.exe windows x86
b4a6f395a79397c631522f31c80fae41
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
Sleep
WinExec
SetFileAttributesA
CreateThread
GetProcAddress
LoadLibraryA
lstrcpyA
TerminateThread
Process32Next
GetLastError
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetTickCount
GetVersionExA
GetLocalTime
WriteFile
lstrlenA
SetFilePointer
CreateFileA
GetModuleFileNameA
DeleteFileA
SetErrorMode
GetModuleHandleA
lstrcmpiA
GetCurrentThreadId
CompareStringW
CompareStringA
CancelIo
GetTimeZoneInformation
FlushFileBuffers
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
SetStdHandle
LCMapStringW
LCMapStringA
SetConsoleCtrlHandler
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
InterlockedIncrement
InterlockedDecrement
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
InterlockedExchange
SetEvent
ResetEvent
WaitForSingleObject
InitializeCriticalSection
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
GetLocaleInfoW
HeapReAlloc
GetCurrentProcess
SetUnhandledExceptionFilter
HeapAlloc
FatalAppExitA
GetCurrentThread
SetLastError
TlsFree
TlsAlloc
HeapFree
ExitProcess
GetVersion
GetCommandLineA
GetStartupInfoA
ExitThread
TlsGetValue
TlsSetValue
RaiseException
RtlUnwind
SetEnvironmentVariableA
user32
DestroyCursor
BlockInput
SystemParametersInfoA
SendMessageA
keybd_event
MapVirtualKeyA
LoadCursorA
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
FindWindowA
ShowWindow
SetCapture
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
LoadIconA
CreateDialogParamA
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
GetCursorPos
GetCursorInfo
ReleaseDC
GetDesktopWindow
GetDC
SetRect
GetSystemMetrics
GetClipboardData
gdi32
CreateCompatibleBitmap
GetDIBits
BitBlt
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteDC
advapi32
OpenProcessToken
GetTokenInformation
LookupAccountSidA
shell32
SHFileOperationA
ShellExecuteA
ws2_32
WSAStartup
WSACleanup
WSAIoctl
setsockopt
connect
htons
gethostbyname
socket
select
recv
closesocket
send
gethostname
getsockname
wtsapi32
WTSQuerySessionInformationA
WTSFreeMemory
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ