gh0strat | a14c7aef2b7945412234b052b1d936fa67637af842252b5f9fa53c2884e5fbc2

Sharing

Copy URL Twitter E-mail

General

Target

a14c7aef2b7945412234b052b1d936fa67637af842252b5f9fa53c2884e5fbc2
Size

148KB
MD5

b87352e582c99ac6e09c5c85e626ec60
SHA1

b41bf7562a57fd920401af9daf8d85f0fe33bb16
SHA256

a14c7aef2b7945412234b052b1d936fa67637af842252b5f9fa53c2884e5fbc2
SHA512

dd2abeca86fbae764de718133c20c8ac03c4348bb6b2abc23cf213c24dafbc06c42172c38ac0974c5cdbf8536f157322fd3333d5d0665c7be3ee2afca09235a9
SSDEEP

3072:Xy0D5TV7IrrADihMMFJJDS8TUoFByNlAmaxgc:C0D550Wi+IJ5nVyda

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

a14c7aef2b7945412234b052b1d936fa67637af842252b5f9fa53c2884e5fbc2
.dll windows x86

adf2eae188c98e9467e8e2f4de039907

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetLocalTime
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
HeapAlloc
UnmapViewOfFile
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
LocalSize
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcmpiA
GetCurrentThreadId
MoveFileExA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
InterlockedIncrement
InterlockedDecrement
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
HeapSize
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
ExitProcess
GetModuleHandleA
TlsFree
TlsAlloc
GetVersion
GetCommandLineA
ExitThread
TlsGetValue
TlsSetValue
HeapReAlloc
RaiseException
RtlUnwind
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
GetSystemDirectoryA
SetLastError
GetModuleFileNameA
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
CreateEventA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
Sleep
CancelIo
InterlockedExchange
lstrcpyA
ResetEvent
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
CloseHandle

user32

CharNextA
GetWindowTextA
GetActiveWindow
GetKeyNameTextA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
LoadCursorA
DestroyCursor
BlockInput
SystemParametersInfoA
SendMessageA
keybd_event
wsprintfA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
GetCursorPos
GetMessageA
TranslateMessage
PostMessageA
IsWindow
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
DispatchMessageA
CreateWindowExA
MapVirtualKeyA
ExitWindowsEx
GetWindowThreadProcessId
IsWindowVisible
GetDC
GetDesktopWindow
ReleaseDC
EnumWindows
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
GetCursorInfo

gdi32

CreateCompatibleBitmap
GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject

advapi32

LsaRetrievePrivateData
IsValidSid
LookupAccountNameA
LsaClose
GetTokenInformation
LookupAccountSidA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
LsaFreeMemory
LsaOpenPolicy

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA

wininet

InternetOpenA
InternetCloseHandle
InternetOpenUrlA
InternetReadFile

shlwapi

SHDeleteKeyA

winmm

waveInStop
waveOutWrite
waveInStart
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveOutPrepareHeader
waveOutOpen
waveOutGetNumDevs
waveInAddBuffer

ws2_32

socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
recv
closesocket
select
send
gethostname
getsockname
ntohs

imm32

ImmGetContext
ImmGetCompositionStringA
ImmReleaseContext

avicap32

capCreateCaptureWindowA
capGetDriverDescriptionA

msvfw32

ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICSeqCompressFrame

psapi

EnumProcessModules
GetModuleFileNameExA

wtsapi32

WTSQuerySessionInformationA
WTSFreeMemory

Exports

Exports

TestRun

Sections

.text
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

adf2eae188c98e9467e8e2f4de039907

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

wininet

shlwapi

winmm

ws2_32

imm32

avicap32

msvfw32

psapi

wtsapi32

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 96KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 20KB - Virtual size: 21KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 96KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 20KB - Virtual size: 21KB

.reloc
Size: 8KB - Virtual size: 7KB