gh0strat | 91c38eee44d84308dd65d6d1c333cdbd13fe346e974c193ae75fd10bc59654e3

Sharing

Copy URL

Twitter E-mail

General

Target

91c38eee44d84308dd65d6d1c333cdbd13fe346e974c193ae75fd10bc59654e3
Size

122KB
MD5

b716f13c035a3633cd96c4707d5f8111
SHA1

9e66a7427341df79aeb9f537799cf4639020c26f
SHA256

91c38eee44d84308dd65d6d1c333cdbd13fe346e974c193ae75fd10bc59654e3
SHA512

83c4830ca0545bb53969cad3421790c77ae5a0ad0df86327428a30d72411767a8a4ffae6607b02697445bde30f89e8061803978fee9283ca373afdd28e0fd0f1
SSDEEP

3072:pYQj0XLXcCS2MRczZK8/y4pE2IybZuwW1PMOo:pIbDMGJyE51ZuwWB

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

91c38eee44d84308dd65d6d1c333cdbd13fe346e974c193ae75fd10bc59654e3
.exe windows x86

03f2c2376dbaab48c69a23e5f572970b

Code Sign

61:38:d8:79:f1:32:37:b2:42:b1:f1:22:5c:51:e6:18
Certificate

Issuer

CN=TEST USE ONLY

Not Before

31/12/1999, 15:00

Not After

30/12/2099, 15:00

Subject

CN=TEST USE ONLY

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:2d:1b:d6:a6:19:aa:41:9b:81:32:11:9b:10:e4:44:7e:a2:2e:9e
Signer

Actual PE Digest

52:2d:1b:d6:a6:19:aa:41:9b:81:32:11:9b:10:e4:44:7e:a2:2e:9e

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=TEST USE ONLY

11/08/2012, 11:27
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventA
GetProcAddress
LoadLibraryA
FindResourceA
WaitForSingleObject
GetModuleHandleA
LoadResource
LockResource
SizeofResource
GetTickCount
GetModuleFileNameA
DeleteFileA
CreateFileA
WriteFile
CloseHandle
Sleep
FreeResource
GetWindowsDirectoryA
GetStartupInfoA

user32

LoadIconA
RegisterClassA
LoadCursorA

gdi32

GetStockObject

advapi32

RegCreateKeyExA
ControlService
StartServiceA
RegOpenKeyA
RegSetValueExA
RegCloseKey
OpenServiceA
OpenSCManagerA
ChangeServiceConfigA

msvcrt

sprintf
rand
srand
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

3`ZPReob
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

[2]#j0`5
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

v>)F3;5Z
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

vM43Lr<b
Size: 113KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

JX%ncCi^
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

03f2c2376dbaab48c69a23e5f572970b

Code Sign

61:38:d8:79:f1:32:37:b2:42:b1:f1:22:5c:51:e6:18Certificate

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

52:2d:1b:d6:a6:19:aa:41:9b:81:32:11:9b:10:e4:44:7e:a2:2e:9eSigner

Signature Validations

Verification

11/08/2012, 11:27 Valid: false

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcrt

Sections

3`ZPReob Size: 1KB - Virtual size: 1KB

[2]#j0`5 Size: 1KB - Virtual size: 1KB

v>)F3;5Z Size: 512B - Virtual size: 252B

vM43Lr<b Size: 113KB - Virtual size: 116KB

JX%ncCi^ Size: 512B - Virtual size: 80B

61:38:d8:79:f1:32:37:b2:42:b1:f1:22:5c:51:e6:18
Certificate

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

52:2d:1b:d6:a6:19:aa:41:9b:81:32:11:9b:10:e4:44:7e:a2:2e:9e
Signer

11/08/2012, 11:27
Valid: false

3`ZPReob
Size: 1KB - Virtual size: 1KB

[2]#j0`5
Size: 1KB - Virtual size: 1KB

v>)F3;5Z
Size: 512B - Virtual size: 252B

vM43Lr<b
Size: 113KB - Virtual size: 116KB

JX%ncCi^
Size: 512B - Virtual size: 80B