gh0strat | 7b8aa9ee8b7087711806ae02aafbe63be355836b2d8f5ccaf5cdcea192312774

Sharing

Copy URL Twitter E-mail

General

Target

7b8aa9ee8b7087711806ae02aafbe63be355836b2d8f5ccaf5cdcea192312774
Size

149KB
MD5

a5a0cfbe1dc3f7c001ba9d6fecfef570
SHA1

9b45b1dbb3b86868c50e5b1cbcf23a07fa5e136e
SHA256

7b8aa9ee8b7087711806ae02aafbe63be355836b2d8f5ccaf5cdcea192312774
SHA512

9960ff4e4fb29e03b0e4f28504c20a07403a8edad00f8a5f52ab650175c54def63c62f8fb884d650c97cc1726cffec3f77898909251417f2eaeaae7f16a75b1d
SSDEEP

3072:ZGaVpdAJQa/DjuTUMPrhdlotV1tqZXTTBft/BPAGTAFDy9:PP0DpMPetXtqZXTTBl/BPAq/

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

7b8aa9ee8b7087711806ae02aafbe63be355836b2d8f5ccaf5cdcea192312774
.dll windows x86

56cc977ca4fab314b84605ca17273360

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

DestroyWindow
CloseWindowStation
MessageBoxA
LoadCursorA
DestroyCursor
GetCursorInfo
ShowWindow
wvsprintfA
CreateWindowExA
wsprintfA

advapi32

RegOpenKeyExW

kernel32

GetExitCodeProcess
ExitProcess
GetShortPathNameA
RaiseException
MapViewOfFile
IsBadWritePtr
FormatMessageA
GetLocalTime
CreateFileMappingA
GetModuleFileNameA
Sleep
CloseHandle
InterlockedExchange
lstrcatA
GetSystemDirectoryA
FreeLibrary
MultiByteToWideChar
lstrlenA
GetProcAddress
WideCharToMultiByte
lstrcpyA
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetVersionExA
lstrcmpiA
ExpandEnvironmentStringsA
GetModuleHandleA
GetTickCount
LocalFree
GetLastError
LocalReAlloc
LocalSize
LocalAlloc
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
VirtualFree
LeaveCriticalSection
VirtualAlloc
GetCurrentThreadId
HeapFree
HeapAlloc
GetProcessHeap
GetSystemInfo
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
GlobalFree
GlobalAlloc
GetTempFileNameA
DeleteFileA
RemoveDirectoryA
ExitThread
LoadLibraryA
IsBadReadPtr
IsBadStringPtrW
GlobalUnlock
GlobalLock
GlobalSize
VirtualQuery
GetCurrentProcessId
VirtualProtect
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
SetUnhandledExceptionFilter

msvcrt

memmove
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_strupr
_strlwr
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
wcsrchr
strchr
strncat
_except_handler3
rand
srand
_ftol
strncpy
free
malloc
_memicmp
ceil
strstr
wcslen
_beginthreadex
atoi
wcstombs
_CxxThrowException
strrchr
_wcsicmp

Exports

Exports

TestProject

Sections

.text
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56cc977ca4fab314b84605ca17273360

Headers

File Characteristics

Imports

user32

advapi32

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 94KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 16KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 96KB - Virtual size: 94KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB