Behavioral task
behavioral1
Sample
c149b2a8ca0ea3da6c0064fac593d213ac9f30aded9e6deec21ea7387c62b8e3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c149b2a8ca0ea3da6c0064fac593d213ac9f30aded9e6deec21ea7387c62b8e3.exe
Resource
win10v2004-20220812-en
General
-
Target
c149b2a8ca0ea3da6c0064fac593d213ac9f30aded9e6deec21ea7387c62b8e3
-
Size
5.2MB
-
MD5
7fa42bed81de10c1043b11e4de607c6f
-
SHA1
b4f63b9e7e983204c2db1e79b6df46ec5ab414a9
-
SHA256
c149b2a8ca0ea3da6c0064fac593d213ac9f30aded9e6deec21ea7387c62b8e3
-
SHA512
adf1e657ff38b6071b8376555bfeb7e3c8fc5e58e32ae116b653b965c3458bc7513fdf46d3f77ed67a9231448987c6239eef28b9bca3df34b9cd4d96d54bc5a3
-
SSDEEP
3072:iI1WbJFtqTZ805ealC0WHACFOXvwtRST2kM3J5O3ttUtQhJrk6:91+FtqMaMdACgv3T2Z3JI3ttzJQ6
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
c149b2a8ca0ea3da6c0064fac593d213ac9f30aded9e6deec21ea7387c62b8e3.exe windows x86
b62570a0636c6c83e13bbf1126dbaa89
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
SetEvent
ResumeThread
CreateThread
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
ResetEvent
lstrcpyA
InterlockedExchange
CancelIo
Sleep
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
GetWindowsDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
DeleteFileA
GetLastError
CreateDirectoryA
GetFileAttributesA
CreateProcessA
WinExec
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
GetModuleFileNameA
SetLastError
GetSystemDirectoryA
TerminateThread
OutputDebugStringA
GlobalMemoryStatusEx
GetComputerNameA
GetTickCount
LocalSize
GetCurrentProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
ExitProcess
HeapFree
HeapAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GlobalMemoryStatus
GetSystemInfo
CopyFileA
GetLogicalDrives
SetFileAttributesA
ExpandEnvironmentStringsA
GetModuleHandleA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
ReleaseMutex
OpenEventA
SetErrorMode
MoveFileExA
SetPriorityClass
GetCurrentProcessId
CreateMutexA
GetCurrentThreadId
lstrcmpiA
SetEnvironmentVariableA
CompareStringW
CompareStringA
CloseHandle
GetLocalTime
CreateEventA
RtlUnwind
RaiseException
HeapReAlloc
GetTimeZoneInformation
GetSystemTime
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
TlsAlloc
SetUnhandledExceptionFilter
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
IsBadReadPtr
IsBadCodePtr
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
SetEndOfFile
netapi32
NetLocalGroupAddMembers
NetUserAdd
avicap32
capGetDriverDescriptionA
capCreateCaptureWindowA
Sections
.text Size: 141KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ