gh0strat | 945499b31fe0b0695f74abc6453cce33d248f65b2e9110d2d769e50d045b5d2c

Sharing

Copy URL Twitter E-mail

General

Target

945499b31fe0b0695f74abc6453cce33d248f65b2e9110d2d769e50d045b5d2c
Size

109KB
MD5

d381f6a57a7dbd981460111275f0dcf1
SHA1

f818824d8e3c8a3bf5b853e5f94289b6829de582
SHA256

945499b31fe0b0695f74abc6453cce33d248f65b2e9110d2d769e50d045b5d2c
SHA512

38671fed202bd3f7929bfdc9af5ea319423f62a433cad89866846dcbd300b44b405e1de05ffa5faf5ed7491a243ecf3398fa38d7d7d199bba145d7d81fb399dc
SSDEEP

3072:N7hyTISyM7Du8UJ+f2PyrHlfUDft7cdqaVTw3TkUaDUqnQ:byTISyM7K8Usf2O6Z7kbVw3QUaIoQ

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

945499b31fe0b0695f74abc6453cce33d248f65b2e9110d2d769e50d045b5d2c
.exe windows x86

79e62a9abe686e92caf54861b4300ebb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetTempPathA
lstrcpyA
lstrcmpiA
SetLastError
GetFileAttributesA
lstrcmpA
FindResourceA
SetFilePointer
GetModuleFileNameA
SetUnhandledExceptionFilter
ReleaseMutex
CreateMutexA
GetCommandLineA
GetCurrentThreadId
GetStartupInfoA
LoadResource
CreateFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SizeofResource
WriteFile
lstrlenA
CloseHandle
FreeResource
MoveFileA
SetFileAttributesA
DeleteFileA
GetSystemDirectoryA
HeapFree
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
lstrcatA
Sleep
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentProcess
VirtualAllocEx
VirtualProtectEx
VirtualFreeEx
GetLastError
GetProcessHeap
HeapAlloc
GetModuleHandleA
GetProcAddress
ReadFile

user32

mouse_event
SetCursorPos
GetClassNameA
GetForegroundWindow
SendMessageA
GetSystemMetrics
wsprintfA
GetMessageA
PostThreadMessageA
FindWindowA
GetCursorPos
FindWindowExA
PostMessageA
GetInputState

advapi32

SetFileSecurityA
RegCloseKey
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
AddAce
GetAce
EqualSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
GetUserNameA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
StartServiceA
OpenServiceA
RegOpenKeyExA

msvcrt

??3@YAXPAX@Z
_stricmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_except_handler3
_local_unwind2
tolower
realloc
malloc
strchr
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
strstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit

netapi32

NetApiBufferFree
NetUserGetLocalGroups

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

79e62a9abe686e92caf54861b4300ebb

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

netapi32

Sections

.text Size: 11KB - Virtual size: 11KB

.rsrc Size: 96KB - Virtual size: 100KB

.text
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 96KB - Virtual size: 100KB