gh0strat | f68a7dd69b43f096580553ec2445ad3d5feff55916172d93374792e288d4ad7a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f68a7dd69b43f096580553ec2445ad3d5feff55916172d93374792e288d4ad7a
Size

159KB
MD5

72754a54ddea661a92b89f69f21b2230
SHA1

c82304a513b303830e1eb8baca6541abb2262c2c
SHA256

f68a7dd69b43f096580553ec2445ad3d5feff55916172d93374792e288d4ad7a
SHA512

e7a6134e3951c1be60c43ebc315737f9f3b66097a2a8d98ce1bf74af857ef0d411df8ab436fd99a4986196959b2784e411accbf62dfecdf014ff47e1478760e4
SSDEEP

768:qiAog6NubRpctrWMV98UgSKLcDASYjvid:qnP6NudGtrWW9ISKP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

f68a7dd69b43f096580553ec2445ad3d5feff55916172d93374792e288d4ad7a
.exe windows x86

30173667f873ae3a460033a3639ab659

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
CreateEventA
GetModuleHandleA
WaitForSingleObject
Sleep
CloseHandle
GetTickCount
GetStartupInfoA

user32

LoadIconA
RegisterClassA
LoadCursorA

gdi32

GetStockObject

advapi32

StartServiceA
ControlService
RegCreateKeyExA
RegOpenKeyA
RegSetValueExA
RegCloseKey
OpenServiceA
OpenSCManagerA
ChangeServiceConfigA

msvcrt

sprintf
rand
srand
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 154KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ