gh0strat | e9782ef09a49fc864f793771928c45582a5a2ee9606ade09096fdb5c4c884efc

Sharing

Copy URL Twitter E-mail

General

Target

e9782ef09a49fc864f793771928c45582a5a2ee9606ade09096fdb5c4c884efc
Size

215KB
MD5

321c9f8497f3105077ced011611aeb21
SHA1

373c5a35903388d99eef88128959fdb42a6dec8a
SHA256

e9782ef09a49fc864f793771928c45582a5a2ee9606ade09096fdb5c4c884efc
SHA512

58541d92a2745d1bbf845928be1fd9985dcba4c4779f10cc123745a2c96d4a22961465c714abd797c33d4c1ca5318677dc62a83c11ff45c3cc4f4a4b11a733ff
SSDEEP

3072:iDkp2ElPyCNOH1JcwJlOgBPE6GVnqThuE1a2WCe:iDCn/NOVJcwJbBcVmhh0Ce

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

e9782ef09a49fc864f793771928c45582a5a2ee9606ade09096fdb5c4c884efc
.dll windows x86

04235229ad34df1f1e22dd53f404d60f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord825
ord1168
ord1253
ord342
ord1182
ord823

msvcrt

_stricmp
_beginthreadex
strncat
tolower
wcscpy
_errno
??1type_info@@UAE@XZ
__dllonexit
_except_handler3
strncpy
exit
atoi
strrchr
_strnicmp
free
malloc
strchr
_CxxThrowException
__CxxFrameHandler
strstr
_ftol
ceil
memmove
_onexit
_snprintf
_initterm
_adjust_fdiv
strncmp
_strnset

kernel32

InitializeCriticalSection
GetProcAddress
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
Sleep
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
DeviceIoControl
lstrcpyA
SetErrorMode
GetCurrentProcess
GetModuleHandleA
DuplicateHandle
CreateThread
MultiByteToWideChar
GetLocalTime
PeekNamedPipe
lstrcmpiA

user32

WindowFromPoint
SetCursorPos
wsprintfA
GetSystemMetrics
SetRect
GetDC
ReleaseDC
PostQuitMessage
GetCursorPos
IsWindowVisible
GetWindow
PostMessageA
CloseWindow
SendMessageA
IsWindow
DefWindowProcA
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA
GetWindowTextA
DestroyCursor
SetCapture

gdi32

SelectObject
CreateCompatibleDC
DeleteObject
DeleteDC
BitBlt
GetDIBits
CreateCompatibleBitmap
CreateDIBSection

advapi32

LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
IsValidSid
GetTokenInformation
LookupAccountSidA

shell32

SHGetFolderPathA
SHGetSpecialFolderPathA

ntdll

_strupr

ws2_32

recvfrom
sendto
accept
setsockopt
gethostbyname
WSACleanup
getpeername
getsockname
bind
listen
inet_addr
recv
__WSAFDIsSet
ioctlsocket
send
select
ntohs
closesocket
socket
htons
connect
WSAStartup
inet_ntoa

msvcp60

?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

msvfw32

ICSeqCompressFrame
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd

psapi

EnumProcessModules
GetModuleFileNameExA

wtsapi32

WTSQuerySessionInformationA
WTSFreeMemory

Exports

Exports

CreateLogObjects

Sections

.text
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

04235229ad34df1f1e22dd53f404d60f

Headers

File Characteristics

Imports

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ntdll

ws2_32

msvcp60

avicap32

msvfw32

psapi

wtsapi32

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 155KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 20KB - Virtual size: 360KB

.rsrc Size: 4KB - Virtual size: 832B

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 156KB - Virtual size: 155KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 20KB - Virtual size: 360KB

.rsrc
Size: 4KB - Virtual size: 832B

.reloc
Size: 20KB - Virtual size: 19KB