gh0strat | d1a6e1816ebd5da1bc487620a63cec0eba211fdae933d19a2aae914cd48d1017

Sharing

Copy URL Twitter E-mail

General

Target

d1a6e1816ebd5da1bc487620a63cec0eba211fdae933d19a2aae914cd48d1017
Size

148KB
MD5

50359f5b2ebfb0b212f9420d86fefbf0
SHA1

24cb5d00806f15768a5b053b8337bacae3afa4dd
SHA256

d1a6e1816ebd5da1bc487620a63cec0eba211fdae933d19a2aae914cd48d1017
SHA512

1afb3a385f97651677e41ec7a07b61130d9acc5f6181a68d43cae20263e61e478248e85c65e8e79039317c98d30f4ef6360078983949c4af224147a3ad10265f
SSDEEP

3072:Jv/XRTx4sYMw66tJZeUbUGWqOweLTBftD0SHyJrN4H:JHXFx4+fmpbU/3LTBlD0My

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

d1a6e1816ebd5da1bc487620a63cec0eba211fdae933d19a2aae914cd48d1017
.dll windows x86

19208e633b826fd2f1e22114c9fc4c9a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHDeleteKeyA

user32

SendMessageTimeoutA
MessageBoxA
CloseWindowStation
CreateWindowExA
DestroyWindow
wvsprintfA
LoadCursorA
DestroyCursor
PtInRect
GetCursorInfo
GetClassNameA
GetWindow
ShowWindow
EnableWindow
CopyRect
wsprintfA
GetWindowRect

kernel32

RaiseException
LoadLibraryA
IsBadWritePtr
LocalAlloc
GetLongPathNameA
GetTempPathA
SetEnvironmentVariableA
GetFileAttributesExA
GetCurrentProcessId
GetCommandLineA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
lstrcmpA
InterlockedExchange
LeaveCriticalSection
GetTickCount
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetCurrentThreadId
lstrcmpiA
GetShortPathNameA
GetTempFileNameA
VirtualQuery
InitializeCriticalSection
GetProcAddress
GetVersionExA
GetSystemInfo
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
GetSystemDirectoryA
HeapFree
GetProcessHeap
HeapAlloc
DeleteFileA
RemoveDirectoryA
ExitThread
GetModuleFileNameA
IsBadReadPtr
IsBadStringPtrW
GetLastError
GetLocalTime
GetModuleHandleA
SetUnhandledExceptionFilter
FormatMessageA
ExitProcess
FreeLibrary
MultiByteToWideChar

advapi32

RegSaveKeyA
RegRestoreKeyA
RegisterServiceCtrlHandlerExA
RegOpenKeyExW

msvcrt

atoi
_beginthreadex
_onexit
__dllonexit
_adjust_fdiv
_initterm
_stricmp
_wcsicmp
_strupr
_strlwr
_memicmp
realloc
_callnewh
strncat
_except_handler3
__CxxFrameHandler
free
strrchr
malloc
memmove
ceil
_ftol
strncpy
wcstombs
strchr
rand
srand
time
wcslen

Exports

Exports

DllMain
EditAuditInfo
EditOwnerInfo
EditPermissionInfo
FMExtensionProcW
SedDiscretionaryAclEditor

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 294B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

19208e633b826fd2f1e22114c9fc4c9a

Headers

File Characteristics

Imports

shlwapi

user32

kernel32

advapi32

msvcrt

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 99KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 294B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 99KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 294B

.reloc
Size: 8KB - Virtual size: 7KB