gh0strat | dd9b4b0acc01293508ab3debe6875a8f1b419f9d2e1fee5eebd2a3bc241f2534

General

Target

dd9b4b0acc01293508ab3debe6875a8f1b419f9d2e1fee5eebd2a3bc241f2534
Size

112KB
MD5

3be1a57dd135a3b876ebb268777372ad
SHA1

43efe0f865353bdf5723f3deadeabe563a42e279
SHA256

dd9b4b0acc01293508ab3debe6875a8f1b419f9d2e1fee5eebd2a3bc241f2534
SHA512

9b1bcb2a4ce5a4c801d044d4bd232d85038c43a99c86c494169335b13566ff6b9ab7a7b5de0a0c23ca9abc81395a9d7465b32519ae32fa619db673188cbab062
SSDEEP

3072:T6iSztxZihOPZOuWW/nddLrMetLdMdsh:T6z3ZAUZxFdXZxMdsh

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

dd9b4b0acc01293508ab3debe6875a8f1b419f9d2e1fee5eebd2a3bc241f2534
.exe windows x86

73d419e84fcba56c212a92e0a791ae82

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
lstrcatA
GetTempPathA
CreateFileA
FindResourceA
lstrcmpiA
SetLastError
GetLastError
GetFileAttributesA
lstrcpyA
lstrlenA
SetFileTime
GetProcAddress
LoadLibraryA
GetModuleFileNameA
SetUnhandledExceptionFilter
ReleaseMutex
CreateMutexA
GetCommandLineA
CopyFileA
OutputDebugStringA
SystemTimeToFileTime
LocalFileTimeToFileTime
CloseHandle
SizeofResource
WriteFile
GetSystemDirectoryA
ExitProcess
FreeLibrary
DeleteFileA
MoveFileA
SetFileAttributesA
GetFileType
GetEnvironmentVariableA
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetVersion
HeapAlloc
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
IsBadCodePtr
IsBadReadPtr
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW

user32

wsprintfA

advapi32

CreateServiceA
OpenSCManagerA
RegCreateKeyA
RegOpenKeyExA
CloseServiceHandle
RegCloseKey
RegSetValueExA
RegQueryValueExA
OpenServiceA
StartServiceA

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

73d419e84fcba56c212a92e0a791ae82

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Sections

.text Size: 20KB - Virtual size: 20KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 10KB - Virtual size: 11KB

.rsrc Size: 77KB - Virtual size: 76KB

.text
Size: 20KB - Virtual size: 20KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 10KB - Virtual size: 11KB

.rsrc
Size: 77KB - Virtual size: 76KB