gh0strat | ade028d3bd7cd750953d10063a2904d7f260fbe9a8867291f51291ba8ac6b6ab

Sharing

Copy URL Twitter E-mail

General

Target

ade028d3bd7cd750953d10063a2904d7f260fbe9a8867291f51291ba8ac6b6ab
Size

152KB
MD5

dfb783384085d6a61e4c7f644d8dbbc5
SHA1

03738ffbfae5bc12c7187c61b76885fd4d1c3631
SHA256

ade028d3bd7cd750953d10063a2904d7f260fbe9a8867291f51291ba8ac6b6ab
SHA512

3aca5723c0c140e16e47b81c15d12db2066627211dc7f5829beefa60f0633496fe4060488b9a20c5d533cf167c09ee61268e5d77735e10a39ba8e93f72552a05
SSDEEP

3072:yliwuiUkuvOr3Y24uQzsW59IC1ObGNTBftA9yhHKsrI:ylUJvOTR4x4c+bGNTBlA9yhHK

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

ade028d3bd7cd750953d10063a2904d7f260fbe9a8867291f51291ba8ac6b6ab
.dll windows x86

0725eec2074addc02fb4ef34054790df

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DestroyWindow
BlockInput
LoadCursorA
DestroyCursor
GetCursorInfo
GetClassNameA
GetWindow
FindWindowA
ShowWindow
wvsprintfA
MessageBoxA
CloseWindowStation
CreateWindowExA
wsprintfA

advapi32

RegOpenKeyExW

kernel32

GetExitCodeProcess
ExitProcess
IsBadStringPtrW
IsBadReadPtr
FreeLibraryAndExitThread
RaiseException
RemoveDirectoryA
DeleteFileA
GlobalMemoryStatusEx
GetProcessTimes
GetSystemInfo
ExitThread
GetModuleFileNameA
GetTickCount
Sleep
CloseHandle
lstrlenA
lstrcatA
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
HeapAlloc
GetLastError
lstrcpyA
LocalFree
LocalAlloc
ExpandEnvironmentStringsA
LocalReAlloc
lstrcmpiA
GetVersionExA
GetCurrentThreadId
GetProcAddress
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
InterlockedExchange
GlobalFree
GlobalAlloc
GetModuleHandleA
LocalSize
MultiByteToWideChar
FreeLibrary
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
Thread32Next
VirtualQuery
OpenThread
Thread32First
GetCurrentProcessId
GetSystemDirectoryA
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
LoadLibraryA
GetCurrentProcess
InitializeCriticalSection
LeaveCriticalSection
SuspendThread
ResumeThread
VirtualFree
VirtualAlloc
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
GetTempFileNameA

msvfw32

ICGetInfo

msvcrt

srand
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_wcsicmp
_itoa
_strlwr
_memicmp
_strupr
wcstombs
atoi
wcsrchr
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
_except_handler3
free
malloc
strstr
strrchr
strncpy
_beginthreadex
wcslen
rand
ceil
_ftol
strchr
strncat
realloc
toupper
tolower
_CxxThrowException
memmove

Exports

Exports

CpyCommon

Sections

.text
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0725eec2074addc02fb4ef34054790df

Headers

File Characteristics

Imports

user32

advapi32

kernel32

msvfw32

msvcrt

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 96KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 96KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB