gh0strat | f5ce0895952056b9ba875d475dc9029a7679fbe69b2430378d476c53b662fcd4 | Triage

Sharing

General

Target

f5ce0895952056b9ba875d475dc9029a7679fbe69b2430378d476c53b662fcd4
Size

160KB
MD5

2d354f129cda59fcddf0d30d97db18cf
SHA1

753425f704add5e5712d059ad96dfe9aeea364fd
SHA256

f5ce0895952056b9ba875d475dc9029a7679fbe69b2430378d476c53b662fcd4
SHA512

32aa3a5aeff68001577afaa08daa931e5ff6ca2c9222f5c9c7f64f864c93bcee1cc61dd58dee6831603b3ac4e2c763af61a2f1794217bd27f7592673a1772e62
SSDEEP

3072:XPeqovIp0YFV6icDdqwnnLLKz7OYtc9BorPuZ5KdA/s8jRfR1HU3:/eqoERFV6icDdqwnnPcOwvf8jRfRS3

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

f5ce0895952056b9ba875d475dc9029a7679fbe69b2430378d476c53b662fcd4
.exe windows x86

8fa21d910d752707e84e3a4519b661e3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
LoadLibraryA
CreateFileA
CreateEventA
GetSystemDirectoryA
GetWindowsDirectoryA
GetTickCount
GetModuleHandleA
CloseHandle
WriteFile
Sleep
FreeResource
WaitForSingleObject
GetStartupInfoA

user32

wsprintfA

msvcrt

strlen
sprintf
rand
srand
memset
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ