gh0strat | aaae20a4aa99c1b333f12ca2a9ec7b833a0108ca1032131c9f643a11b430160b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aaae20a4aa99c1b333f12ca2a9ec7b833a0108ca1032131c9f643a11b430160b
Size

904KB
MD5

23a01de194004e4513156a62f9bdc3f1
SHA1

69d3a7a2b8d1f0bcf68e1c1f3d99140cd851640c
SHA256

aaae20a4aa99c1b333f12ca2a9ec7b833a0108ca1032131c9f643a11b430160b
SHA512

a6be0e264cc18881f695e87e53346251894c8cc773370d707108a40d08e5ad909c4340ac1e9e0bb7ae57ab686ae68b3c88563e3f925265667d2be32e6f09dc79
SSDEEP

3072:9GWHH9Qfm+OPC8XQeawqKOMvuyTBft6cC8RUURXYSKBL83iL:9DdGGa5mqivuyTBlPUyXZmSiL

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

aaae20a4aa99c1b333f12ca2a9ec7b833a0108ca1032131c9f643a11b430160b
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

CreateTexture
D3DBreakVBLock
D3DFree
D3DMalloc
D3DRealloc
D3DTextureUpdate
DestroyTexture
Direct3DCreate
Direct3DCreateDevice
Direct3D_HALCleanUp
FlushD3DDevices
GetLOD
GetPriority
PaletteAssociateNotify
PaletteUpdateNotify
SetLOD

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ