gh0strat | f7b183cab525d9121e91ad6bfd84ee5efa5dd6afc82d944946120ecf5a67eebc

General

Target

f7b183cab525d9121e91ad6bfd84ee5efa5dd6afc82d944946120ecf5a67eebc
Size

152KB
MD5

0f4621785968fe8a7bcc7c0e71117601
SHA1

613251db74c47b5ff2e47b49d2cf06ae3f795ee3
SHA256

f7b183cab525d9121e91ad6bfd84ee5efa5dd6afc82d944946120ecf5a67eebc
SHA512

75dcf2a758286885f2d744e75b3ad30fbbd54a4b11812b35f681ca7d34d40474a3bf7918814921daff73ad0786f8ef053d8d05bae0d8bad7a80302e3756f4b4c
SSDEEP

3072:kTftWJ3U02qSGsKXDalELSILWcReYDATBftM1v2F:kztWsbBKKESIL1eYDATBlM1v2

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

f7b183cab525d9121e91ad6bfd84ee5efa5dd6afc82d944946120ecf5a67eebc
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

DbgHelpCreateUserDump
DbgHelpCreateUserDumpW
EnumDirTree
EnumerateLoadedModules
EnumerateLoadedModules64
ExtensionApiVersion
FindDebugInfoFile
FindDebugInfoFileEx
FindExecutableImage
FindExecutableImageEx
FindFileInPath
FindFileInSearchPath
GetTimestampForLoadedLibrary
ImageDirectoryEntryToData
ImageDirectoryEntryToDataEx
ImageNtHeader
ImageRvaToSection
ImageRvaToVa
ImagehlpApiVersion
ImagehlpApiVersionEx
MakeSureDirectoryPathExists
MapDebugInformation
MiniDumpReadDumpStream
MiniDumpWriteDump
SearchTreeForFile
StackWalk
StackWalk64
SymAddSymbol
SymCleanup
SymDeleteSymbol
SymEnumLines
SymEnumSourceFiles
SymEnumSym
SymEnumSymbols
SymEnumSymbolsForAddr
SymEnumTypes
SymEnumerateModules
SymEnumerateModules64
SymEnumerateSymbols
SymEnumerateSymbols64
SymEnumerateSymbolsW
SymEnumerateSymbolsW64
SymFindFileInPath
SymFromAddr
SymFromName
SymFromToken
SymFunctionTableAccess
SymFunctionTableAccess64
SymGetFileLineOffsets64
SymGetHomeDirectory

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 97KB

.rdata Size: 28KB - Virtual size: 27KB

.data Size: 12KB - Virtual size: 14KB

.reloc Size: 8KB - Virtual size: 6KB

.text
Size: 100KB - Virtual size: 97KB

.rdata
Size: 28KB - Virtual size: 27KB

.data
Size: 12KB - Virtual size: 14KB

.reloc
Size: 8KB - Virtual size: 6KB