gh0strat | e6e22bdbd8fc7f0734e7b5ac1bed7d6062e493d761aeaf7354fbeb7a52918bb4

Sharing

Copy URL Twitter E-mail

General

Target

e6e22bdbd8fc7f0734e7b5ac1bed7d6062e493d761aeaf7354fbeb7a52918bb4
Size

152KB
MD5

32103fc30556abe6678933930f7cb4c0
SHA1

5a62ac8131dd8f79f8c7f9d000dfe7bc6f8acb17
SHA256

e6e22bdbd8fc7f0734e7b5ac1bed7d6062e493d761aeaf7354fbeb7a52918bb4
SHA512

133c5de54f33b0073f6950778300ddc95fcb199eaa18d8ef59b12dcdb71d7f4682232fd39ed2a079dd2b7424e6824da251052d94c7830f985f71da9fc062e4da
SSDEEP

3072:d4NlDIfgyMJDu1yGapDHgErHS2jhATBftCfl6G:d4zUT+DPl5HgABjhATBlCN

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

e6e22bdbd8fc7f0734e7b5ac1bed7d6062e493d761aeaf7354fbeb7a52918bb4
.dll windows x86

a6b1b97224ebe109e81ee44608f5a4fc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
GetWindowRect
MessageBoxA
LoadCursorA
ShowWindow
GetCursorInfo
CreateWindowExA
DestroyWindow
wvsprintfA
GetWindow
GetClassNameA
DestroyCursor
CloseWindowStation

oleaut32

SysFreeString

shlwapi

StrStrIA

kernel32

GetLongPathNameA
RaiseException
GetShortPathNameA
CreateFileMappingA
MapViewOfFile
InterlockedIncrement
InterlockedDecrement
IsBadWritePtr
FormatMessageA
GetLocalTime
SetUnhandledExceptionFilter
VirtualAlloc
VirtualFree
LoadLibraryA
GetTempPathA
SetEnvironmentVariableA
HeapFree
HeapAlloc
GetProcessHeap
CloseHandle
lstrlenA
GetSystemInfo
GetVersionExA
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
GetLastError
FreeLibrary
GlobalFree
GlobalAlloc
GetProcAddress
GetModuleHandleA
GetTempFileNameA
lstrcpyA
lstrcatA
GetSystemDirectoryA
Sleep
GetTickCount
DeleteFileA
RemoveDirectoryA
ExitThread
GetModuleFileNameA
IsBadReadPtr
IsBadStringPtrW
InterlockedExchange
GlobalUnlock
GlobalLock
GlobalSize
LocalFree
LocalSize
LocalAlloc
LocalReAlloc
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
lstrcmpiA
ExpandEnvironmentStringsA
InitializeCriticalSection
LeaveCriticalSection
ExitProcess
GetExitCodeProcess
GetCurrentThreadId
VirtualQuery
GetCurrentProcessId

iphlpapi

GetAdaptersInfo

userenv

GetUserProfileDirectoryA
GetProfilesDirectoryA

ws2_32

bind
listen
gethostbyname
setsockopt
WSAIoctl
WSACleanup
WSAStartup
accept
connect
select
recv
send
shutdown
closesocket
getsockname
gethostname
__WSAFDIsSet
socket
ioctlsocket

msvcrt

_wcsicmp
??3@YAXPAX@Z
__CxxFrameHandler
strstr
_ftol
srand
rand
??2@YAPAXI@Z
strchr
atoi
strncpy
_except_handler3
wcsrchr
_CxxThrowException
free
malloc
strrchr
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_strupr
_memicmp
_strlwr
wcstombs
ceil
memmove
wcslen
realloc
strncat
_beginthreadex

Exports

Exports

DhcpAcquireParameters
DhcpAcquireParametersByBroadcast
DhcpCApiCleanup
DhcpCApiInitialize
DhcpDeRegisterOptions
DhcpDeRegisterParamChange
DhcpDelPersistentRequestParams
DhcpEnumClasses
DhcpFallbackRefreshParams
DhcpHandlePnPEvent
DhcpLeaseIpAddress
DhcpLeaseIpAddressEx
DhcpNotifyConfigChange
DhcpNotifyConfigChangeEx
DhcpNotifyMediaReconnected
DhcpOpenGlobalEvent
DhcpPersistentRequestParams
DhcpRegisterOptions
DhcpRegisterParamChange
DhcpReleaseIpAddressLease
DhcpReleaseIpAddressLeaseEx
DhcpReleaseParameters
DhcpRemoveDNSRegistrations
DhcpRenewIpAddressLease
DhcpRenewIpAddressLeaseEx
DhcpRequestOptions
DhcpRequestParams
DhcpStaticRefreshParams
DhcpUndoRequestParams
McastApiCleanup
McastApiStartup
McastEnumerateScopes
McastGenUID
McastReleaseAddress
McastRenewAddress
McastRequestAddress
ServiceMain

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a6b1b97224ebe109e81ee44608f5a4fc

Headers

File Characteristics

Imports

user32

oleaut32

shlwapi

kernel32

iphlpapi

userenv

ws2_32

msvcrt

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 97KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 97KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB