gh0strat | d414cae4d4545729548f3e089e7cd82100bb54c28a187b6418a84e190fcb953f

Sharing

Copy URL Twitter E-mail

General

Target

d414cae4d4545729548f3e089e7cd82100bb54c28a187b6418a84e190fcb953f
Size

217KB
MD5

ef4605da9ed40c1f0aefd0894f0d0233
SHA1

4df9997d07cafb85d66b0a1ead4d8fbc735e1c71
SHA256

d414cae4d4545729548f3e089e7cd82100bb54c28a187b6418a84e190fcb953f
SHA512

902d0279c659957a83a912358b5ff3ff213e9b80e2c3df04fe9390e6c2497ddff7a13c0063c745c43dcc9bf21b877d3fb2f726300aa79acd797f37e08a113e04
SSDEEP

3072:rgivARinbxSZPPjqaS6Aai6WqC3Fa93LUgz8a9hU3gtF8KXZ/N:uW2LqauDE97xz8wmQ8KtN

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

d414cae4d4545729548f3e089e7cd82100bb54c28a187b6418a84e190fcb953f
.exe windows x86

93e81a5e6c02db26acd594c237e8f622

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:d8:83:3e:08:a0:37:6d:f4:40:e1:8c:21:94:5a:da:53:29:e1:a7
Signer

Actual PE Digest

d8:d8:83:3e:08:a0:37:6d:f4:40:e1:8c:21:94:5a:da:53:29:e1:a7

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

04/02/2009, 03:39
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LCMapStringW
LCMapStringA
GetCurrentProcess
CloseHandle
OpenProcess
GlobalUnlock
HeapFree
lstrlenA
MultiByteToWideChar
lstrcatA
MoveFileA
GetProcessHeap
HeapAlloc
GetCurrentProcessId
FreeLibrary
CreateThread
Sleep
GetLocalTime
GetTickCount
LoadLibraryA
SetStdHandle
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetFilePointer
InterlockedIncrement
InterlockedDecrement
IsBadCodePtr
IsBadReadPtr
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetFileType
GetStdHandle
SetHandleCount
HeapSize
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
SetUnhandledExceptionFilter
SetLastError
TlsAlloc
DeleteCriticalSection
InitializeCriticalSection
GetVersion
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
ExitThread
TlsGetValue
RtlUnwind
RaiseException
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
GetLastError
GetCurrentThreadId
TlsSetValue

user32

OpenClipboard
GetSystemMetrics
SetRect
ReleaseDC
GetCursorInfo
CreateWindowExA
IsWindow
SendMessageA
LoadCursorA
wsprintfA
EmptyClipboard
DestroyCursor

gdi32

DeleteDC
CreateCompatibleBitmap
GetDIBits
BitBlt
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject

advapi32

DeleteService
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
StartServiceA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

ws2_32

inet_addr
send
socket
gethostbyname
htons
connect
recv
select
closesocket
WSAStartup
ntohs
getsockname
bind
getpeername
accept
listen
__WSAFDIsSet
gethostname
sendto
setsockopt
inet_ntoa
WSACleanup
htonl
WSASocketA

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA

urlmon

URLDownloadToFileA

netapi32

NetUserAdd
NetLocalGroupAddMembers

msvfw32

ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICOpen
ICSendMessage
ICSeqCompressFrameStart
ICSeqCompressFrame

Exports

Exports

aabbccdd
daxuewuli
eeffgghh
gaoshu
gongchengshuxue
iijjkkmm

Sections

.text
Size: 160KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 28KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 688B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

93e81a5e6c02db26acd594c237e8f622

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

d8:d8:83:3e:08:a0:37:6d:f4:40:e1:8c:21:94:5a:da:53:29:e1:a7Signer

Signature Validations

Verification

04/02/2009, 03:39 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ws2_32

wininet

urlmon

netapi32

msvfw32

Exports

Exports

Sections

.text Size: 160KB - Virtual size: 156KB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 28KB - Virtual size: 36KB

.rsrc Size: 4KB - Virtual size: 688B

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

d8:d8:83:3e:08:a0:37:6d:f4:40:e1:8c:21:94:5a:da:53:29:e1:a7
Signer

04/02/2009, 03:39
Valid: false

.text
Size: 160KB - Virtual size: 156KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 28KB - Virtual size: 36KB

.rsrc
Size: 4KB - Virtual size: 688B