gh0strat | e51b9a96bcea12354995125d3b07f5aef58bfe70853812c9c7afd282496f6203

Sharing

Copy URL Twitter E-mail

General

Target

e51b9a96bcea12354995125d3b07f5aef58bfe70853812c9c7afd282496f6203
Size

696KB
MD5

85415cba14366c2f02745e9c05ad40f7
SHA1

5919fb95166629fca679a2f48c2669033e820fc2
SHA256

e51b9a96bcea12354995125d3b07f5aef58bfe70853812c9c7afd282496f6203
SHA512

24279e69573648541007ef73d2a965386b58ac6711f9114ea88147d97efe78cc8016f81e57f12c61b48b3196c7c18723a05bb104320f566e8ff0a0d9511f1cfc
SSDEEP

12288:FQzBKj1+zt6dZLN/iThZKFseQ9X90kmTd649YSQ+wboo9sn:6tum+a1ZKiec9iT/YS9wbvK

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

e51b9a96bcea12354995125d3b07f5aef58bfe70853812c9c7afd282496f6203
.exe windows x86

e3a1545fec7c623f0140327f22b4db44

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedDecrement
WaitForSingleObject
GetProfileStringA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
IsBadCodePtr
IsBadReadPtr
GetDriveTypeA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
HeapReAlloc
ExitThread
TerminateProcess
GetACP
GetLocalTime
GetSystemTime
GetTimeZoneInformation
HeapFree
HeapAlloc
ExitProcess
GetCommandLineA
GetStartupInfoA
RaiseException
RtlUnwind
Sleep
VirtualFree
VirtualAlloc
GlobalAlloc
LockResource
LoadResource
SizeofResource
FindResourceA
GetTickCount
GetFileAttributesA
GetDiskFreeSpaceExA
GetVolumeInformationA
lstrlenA
GetLogicalDriveStringsA
LocalFree
LocalAlloc
lstrcpynA
FindClose
FindNextFileA
FindFirstFileA
CloseHandle
GetFileSize
CreateFileA
WriteFile
SetFilePointer
DeleteFileA
ReadFile
RemoveDirectoryA
MoveFileA
GetLastError
CreateDirectoryA
lstrcpyA
GetProcAddress
LoadLibraryA
SetUnhandledExceptionFilter
GetModuleFileNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
PostQueuedCompletionStatus
EnterCriticalSection
GetSystemInfo
CreateIoCompletionPort
GetQueuedCompletionStatus
CreateThread
InterlockedIncrement
SetEvent
InterlockedExchange
CancelIo
DeleteCriticalSection
lstrcatA
GetSystemDirectoryA
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
LocalSize
FreeLibrary
GetVersionExA
GetVersion
TerminateThread
ResumeThread
GetModuleHandleA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
lstrcmpiA
GlobalGetAtomNameA
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
FormatMessageA
SetLastError
MulDiv
DuplicateHandle
GetCurrentProcess
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFullPathNameA
GetStringTypeExA
GetThreadLocale
GetShortPathNameA
lstrcmpA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetCurrentThread
GetTempFileNameA
SetFileTime
GetFileTime
GetDiskFreeSpaceA
GlobalFlags
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GetProcessVersion
GetCPInfo
GetOEMCP
LocalFileTimeToFileTime
SystemTimeToFileTime
SetErrorMode
GetCurrentDirectoryA

user32

IsDialogMessageA
SetDlgItemTextA
SendDlgItemMessageA
MapWindowPoints
PeekMessageA
SetFocus
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
IsChild
GetCapture
WinHelpA
RegisterClassA
GetMenu
GetWindowTextLengthA
GetWindowTextA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
GetWindowRect
UnregisterClassA
HideCaret
ShowCaret
ExcludeUpdateRgn
DefDlgProcA
IsWindowUnicode
DrawFocusRect
SetWindowLongA
RegisterWindowMessageA
IsIconic
GetWindowPlacement
SetWindowTextA
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
SetMenuDefaultItem
TrackPopupMenu
GetMenuItemID
IsWindow
LoadBitmapA
TrackPopupMenuEx
MoveWindow
ShowWindow
SetMenuItemBitmaps
ModifyMenuA
GetMenuCheckMarkDimensions
wvsprintfA
GetWindowDC
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
DrawTextA
GetMenuState
ShowScrollBar
DrawIconEx
IntersectRect
CheckMenuRadioItem
SetClassLongA
InflateRect
CopyRect
GetClientRect
OffsetRect
DrawStateA
FillRect
GetSysColor
ReleaseDC
GetDC
GetIconInfo
LoadImageA
LoadMenuA
FrameRect
LoadCursorA
DefWindowProcA
GetClassInfoA
GetCursor
DrawFrameControl
SetRectEmpty
SetTimer
SetCapture
ReleaseCapture
GetKeyState
KillTimer
PtInRect
GetSubMenu
CopyIcon
DispatchMessageA
GetMessageA
TranslateMessage
GetWindow
ScreenToClient
UpdateWindow
IsWindowVisible
SetWindowPos
GetDlgCtrlID
BeginPaint
EndPaint
TabbedTextOutA
GrayStringA
LoadStringA
CharUpperA
FindWindowA
IsZoomed
PostQuitMessage
ShowOwnedPopups
ValidateRect
SetWindowContextHelpId
MapDialogRect
LoadAcceleratorsA
TranslateAcceleratorA
ReuseDDElParam
UnpackDDElParam
BringWindowToTop
GetClassNameA
GetSysColorBrush
LoadIconA
SendMessageA
EnableWindow
SetRect
DestroyMenu
DestroyCursor
DestroyIcon
GetWindowLongA
GetNextDlgTabItem
GetParent
SetCursor
InvalidateRect
GetActiveWindow
WindowFromPoint
ClientToScreen
PostMessageA
EndDialog
wsprintfA
MessageBoxA
GetFocus
GetCursorPos
EnableMenuItem
GetMenuItemCount
DeleteMenu
CharNextA
SetMenu
SystemParametersInfoA
PostThreadMessageA
GetDesktopWindow
SetParent
RegisterClipboardFormatA
LockWindowUpdate
GetDCEx
GetNextDlgGroupItem
CopyAcceleratorTableA
IsWindowEnabled
RedrawWindow
DrawEdge
GetSystemMetrics
MessageBeep
CheckMenuItem
AppendMenuA
GetSystemMenu
SetForegroundWindow

gdi32

PtInRegion
GetTextExtentPointA
GetBkColor
GetTextColor
CreateFontA
GetCharWidthA
GetTextMetricsA
GetTextExtentPoint32A
LPtoDP
DPtoLP
CreateRectRgnIndirect
CombineRgn
SetRectRgn
PatBlt
GetMapMode
Escape
RectVisible
PtVisible
CreatePatternBrush
GetWindowExtEx
GetViewportExtEx
GetDeviceCaps
CreateRectRgn
LineTo
MoveToEx
IntersectClipRect
ExcludeClipRect
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
RestoreDC
SaveDC
GetClipBox
CreatePen
RoundRect
SetBkMode
TextOutA
CreateSolidBrush
ExtTextOutA
StretchDIBits
CreateDIBSection
StretchBlt
CreateDIBitmap
CreateFontIndirectA
Rectangle
PlgBlt
FillRgn
CreatePolygonRgn
GetObjectA
GetPixel
CreateBitmap
SelectObject
SetBkColor
SetTextColor
DeleteDC
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetStockObject
DeleteObject

comdlg32

GetOpenFileNameA
GetSaveFileNameA
GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
SetFileSecurityA
GetFileSecurityA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegCreateKeyA
RegSetValueA
RegOpenKeyA

shell32

ord71
ShellExecuteExA
DragQueryFileA
DragFinish
Shell_NotifyIconA
ExtractIconA
ShellExecuteA
SHGetFileInfoA

comctl32

_TrackMouseEvent
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create

oledlg

ord8

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoTaskMemAlloc
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
CoUninitialize
CoInitialize

olepro32

ord253

oleaut32

SysFreeString
SysStringLen
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
VariantChangeType
VariantCopy
VariantTimeToSystemTime
VariantClear

shlwapi

SHAutoComplete

ws2_32

WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSASocketA
setsockopt
WSAGetLastError
accept
socket
WSARecv
WSASend
WSACloseEvent
gethostbyname
gethostname
recv
send
select
connect
ioctlsocket
getpeername
inet_ntoa
WSAIoctl
WSACreateEvent
WSAEventSelect
htons
bind
listen
WSACleanup
closesocket
WSAStartup

pdh

PdhCollectQueryData
PdhGetFormattedCounterValue
PdhOpenQueryA
PdhAddCounterA
PdhCloseQuery

avifil32

AVIFileRelease
AVIStreamWrite
AVIFileOpenA
AVIFileCreateStreamA
AVIStreamSetFormat
AVIFileExit
AVIFileInit
AVIStreamRelease

msvfw32

DrawDibClose
ICDecompress
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
DrawDibDraw
DrawDibOpen

winmm

waveOutClose
waveOutUnprepareHeader
waveOutGetNumDevs
waveOutOpen
waveOutReset
waveOutPrepareHeader
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutWrite
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
PlaySoundA

Sections

.text
Size: 376KB - Virtual size: 373KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 204KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e3a1545fec7c623f0140327f22b4db44

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

shlwapi

ws2_32

pdh

avifil32

msvfw32

winmm

Sections

.text Size: 376KB - Virtual size: 373KB

.rdata Size: 84KB - Virtual size: 82KB

.data Size: 28KB - Virtual size: 43KB

.rsrc Size: 204KB - Virtual size: 200KB

.text
Size: 376KB - Virtual size: 373KB

.rdata
Size: 84KB - Virtual size: 82KB

.data
Size: 28KB - Virtual size: 43KB

.rsrc
Size: 204KB - Virtual size: 200KB