gh0strat | 0d604ae8f4af43ea4f37d778d4e03246875368fea38da0f4ecf780c5dd96272d

General

Target

0d604ae8f4af43ea4f37d778d4e03246875368fea38da0f4ecf780c5dd96272d
Size

183KB
MD5

f0e4fc83a94775f86ebaa742314a7ea6
SHA1

7efa842452a91d87f184cd481ef9f2295f368fba
SHA256

0d604ae8f4af43ea4f37d778d4e03246875368fea38da0f4ecf780c5dd96272d
SHA512

f87e32bc50d0fad47a3f3670fae303482f5cd5b6b0dff47d3d39fed6a94ebecc879da0ade21e5ac1d51158b68796d6c6bda5b1b57b22e3e345ec6b2cac23575a
SSDEEP

3072:oQIzGVMbl2KouncHcQc6ylj2PZriKGlxQ1q6Ss9OsKfNW/++I/s9TBftFDntn7Be:DqGVMbsKoun2cQcBlaPZebQ1q2oNW/+D

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

0d604ae8f4af43ea4f37d778d4e03246875368fea38da0f4ecf780c5dd96272d
.exe windows x86

da3d4466385d03b45c849143902423d1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleHandleA
GetLastError
Sleep
ExitProcess
LoadLibraryA
GetCurrentDirectoryA
GetTempPathA
CloseHandle
WriteFile
SetFilePointer
CreateFileA
WaitForSingleObject
GetCurrentProcess
CreateEventA
ExpandEnvironmentStringsA
GetSystemDirectoryA
SetEnvironmentVariableA
SleepEx
IsBadReadPtr
ExitThread
GetTickCount
GetExitCodeThread
CreateThread
SetUnhandledExceptionFilter
GetCommandLineA
GetCurrentThreadId
GetModuleFileNameA
IsBadWritePtr
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
CreateDirectoryA
DeleteFileA
SetFileAttributesA
GetFileAttributesA
FreeLibrary
LocalAlloc
InterlockedExchange
RaiseException
GetStartupInfoA

shlwapi

PathFileExistsA
SHDeleteKeyA
SHCopyKeyA
SHGetValueA

msvcrt

memset
__CxxFrameHandler
memmove
srand
rand
_ftol
malloc
tolower
strncmp
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_itoa
_strupr
_except_handler3

user32

wsprintfA
GetActiveWindow
FlashWindow

ws2_32

closesocket
getprotobynumber

Sections

CODE
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

da3d4466385d03b45c849143902423d1

Headers

File Characteristics

Imports

kernel32

shlwapi

msvcrt

user32

ws2_32

Sections

CODE Size: 18KB - Virtual size: 20KB

.data Size: 164KB - Virtual size: 166KB

CODE
Size: 18KB - Virtual size: 20KB

.data
Size: 164KB - Virtual size: 166KB