gh0strat | e74d02699c99ebe6e8c50820900f98bfbde96e61a9a50a6e75d7b9cb8d7421ce

Sharing

Copy URL

Twitter E-mail

General

Target

e74d02699c99ebe6e8c50820900f98bfbde96e61a9a50a6e75d7b9cb8d7421ce
Size

220KB
MD5

b5adc0f2951462b8c6bba2dfb348d13b
SHA1

32c9f6ee4d70e28fec06c7f5221e5672de6ad7a5
SHA256

e74d02699c99ebe6e8c50820900f98bfbde96e61a9a50a6e75d7b9cb8d7421ce
SHA512

727e0ebf190b3500ef0e0f66eb8f6972e538d0c57abbf5ae5a83e64565ff8825439d6a3a8df15c547ff44f17afc3c4c84f0d2a1218c57dca1671771eba5dba87
SSDEEP

3072:nVXZfIW8M48y6UIx/fCuwxrzv395rTCihRVNKgtTBftR8U3fqUGwO7yPLF:V9LHKl3frJhRVNdtTBlqln57KF

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

e74d02699c99ebe6e8c50820900f98bfbde96e61a9a50a6e75d7b9cb8d7421ce
.dll windows x86

d226401f77aea4055df3f56fe55354c1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA

advapi32

RegisterServiceCtrlHandlerExA
RegRestoreKeyA
RegSaveKeyA
QueryServiceStatusEx
RegOpenKeyExW

kernel32

GlobalAlloc
ExitProcess
GetLastError
GetModuleHandleA
lstrcmpiA
InitializeCriticalSection
LeaveCriticalSection
GetTickCount
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
HeapAlloc
GetCommandLineA
WinExec
VirtualQuery
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetShortPathNameA
GetFileAttributesExA
lstrcmpA
GetSystemDirectoryA
MultiByteToWideChar
SetEnvironmentVariableA
GetTempPathA
GetCurrentProcess
GetLongPathNameA
GetModuleFileNameA
GetVersionExA
GetTempFileNameA
GetSystemInfo
GetProcessTimes
GlobalMemoryStatusEx
DeleteFileA
RemoveDirectoryA
ExitThread
GetEnvironmentVariableA
GetVersion
IsBadReadPtr
IsBadStringPtrW
GlobalFree
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
InterlockedExchange
FreeLibrary
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA

oleaut32

SysFreeString
SysStringLen
SysAllocString

user32

GetWindowRect
MessageBoxA
CloseWindowStation
wvsprintfA
LoadCursorA
DestroyCursor
PtInRect
GetCursorInfo
CopyRect
SendMessageTimeoutA
CreateWindowExA
DestroyWindow
ShowWindow
GetWindow
GetClassNameA
wsprintfA
EnableWindow

shell32

SHFileOperationA

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize

userenv

GetProfilesDirectoryA
GetUserProfileDirectoryA

ws2_32

closesocket
shutdown
send
recv
select
socket
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
gethostname
gethostbyname
getsockname

msvcrt

rand
srand
time
_ftol
strchr
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
memmove
_wcsicmp
_strupr
_stricmp
_strlwr
_memicmp
wcslen
wcstombs
atoi
atol
_beginthreadex
_callnewh
ceil
_CxxThrowException
realloc
strrchr
strncat
_except_handler3
malloc
free
__CxxFrameHandler

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllGetVersion
DllInstall

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d226401f77aea4055df3f56fe55354c1

Headers

File Characteristics

Imports

shlwapi

advapi32

kernel32

oleaut32

user32

shell32

ole32

userenv

ws2_32

msvcrt

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 103KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 104KB - Virtual size: 103KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB