gh0strat | ff7fc48ce70d04bd309cac09eebc609eec10c1acf695f015991b4338675e134e

Sharing

Copy URL Twitter E-mail

General

Target

ff7fc48ce70d04bd309cac09eebc609eec10c1acf695f015991b4338675e134e
Size

128KB
MD5

a68421c604745255398d373a2513ca7d
SHA1

a619503302f86ea20a75911009b1fa2d0900bfae
SHA256

ff7fc48ce70d04bd309cac09eebc609eec10c1acf695f015991b4338675e134e
SHA512

35c8d332a8f126bea8837531d64efd3696736e0a31306a6304d5c40054ebaa9930d27a274ec0ba44cf8fe7eb4a8c18b10634f8921b7a3238837d4e3544d5eb80
SSDEEP

3072:6UXq0eF4cir4uoX16yH3GCkwJcru4mrKUdSjhb:6UX4FtopDmGMuhb

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

ff7fc48ce70d04bd309cac09eebc609eec10c1acf695f015991b4338675e134e
.exe windows x86

6770a32fb73e7fce18c88f2cfd2d8890

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

avicap32

capGetDriverDescriptionA

msvfw32

ICSendMessage

wininet

InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle

kernel32

LoadLibraryA
ResetEvent
lstrcpyA
InterlockedExchange
GetTickCount
GetLocalTime
Sleep
CreateThread
GetCurrentProcessId
HeapAlloc
GetProcessHeap
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
GetWindowsDirectoryA
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
OutputDebugStringA
DeleteFileA
GetLastError
CreateDirectoryA
GetFileAttributesA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
CloseHandle
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
CreateProcessA
MultiByteToWideChar
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetSystemInfo
GetProcAddress
SetErrorMode
GetStartupInfoA
OpenProcess
CreateEventA
SetEvent
RaiseException
FreeLibrary
GetModuleHandleA
LeaveCriticalSection

user32

PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
EnumWindows
IsWindowVisible
GetCursorPos
GetCursorInfo
ReleaseDC
GetDesktopWindow
GetDC
SetRect
GetSystemMetrics
CreateWindowExA
OpenClipboard
CloseWindow
SetClipboardData
CloseClipboard
mouse_event
SetCursorPos
GetWindowThreadProcessId
SetCapture
MapVirtualKeyA
keybd_event
SendMessageA
SystemParametersInfoA
DestroyCursor
LoadCursorA
GetWindowTextA
ExitWindowsEx
CharNextA
wsprintfA
IsWindow
EmptyClipboard
GetClipboardData
WindowFromPoint

gdi32

CreateCompatibleBitmap
GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject

shell32

SHGetSpecialFolderPathA

msvcrt

__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
??1type_info@@UAE@XZ
calloc
_beginthreadex
strncat
_adjust_fdiv
_strcmpi
puts
wcscpy
_errno
strncmp
strrchr
atoi
_except_handler3
free
malloc
strchr
strncpy
sprintf
rand
__p__commode
__p__fmode
__set_app_type
_controlfp
_strnicmp
exit
??2@YAPAXI@Z
_CxxThrowException
__CxxFrameHandler
strstr
_ftol
ceil
??3@YAXPAX@Z
memmove

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

urlmon

URLDownloadToFileA

netapi32

NetLocalGroupAddMembers
NetUserAdd

psapi

GetModuleFileNameExA
EnumProcessModules

wtsapi32

WTSQuerySessionInformationA
WTSFreeMemory

Sections

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6770a32fb73e7fce18c88f2cfd2d8890

Headers

File Characteristics

Imports

avicap32

msvfw32

wininet

kernel32

user32

gdi32

shell32

msvcrt

msvcp60

urlmon

netapi32

psapi

wtsapi32

Sections

.rdata Size: 12KB - Virtual size: 11KB

.data Size: 92KB - Virtual size: 96KB

.rsrc Size: 20KB - Virtual size: 17KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 92KB - Virtual size: 96KB

.rsrc
Size: 20KB - Virtual size: 17KB