gh0strat | 6318b135503e50e64dd9730a89dcb672[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
6318b135503e50e64dd9730a89dcb672.exe
Size 174KB
Sample230302-trclhsdf66
SHA256 2d073ca86541cb66f339a2966d4ad3216b2fb21cb6018889dabfcf5d8a982e4c
MD5 6318b135503e50e64dd9730a89dcb672
SHA1 c87c028db2ab6b24832a890ab665c822fcf38ace
SHA512 0ec958c3197ae608d0a672715833e0d5b176c33a17315cbf7f30e1cf11b863f05eff929740e64587d574a6dffc9b9c4b5b2497ca392a31e452a646d6ee8738ff
SSDEEP 3072:VJuGnYhTbK80khbOW1oWOQ1f9xHwm1PXBmXZFeA28pMGEdePl9dehiv80P80CnpZ:VJueTk1OwoWOQ3dwaWB28adeP/deUv8M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

File Explorer

6318b135503e50e64dd9730a89dcb672.exe

.exe 174KB

6318b135503e50e64dd9730a89dcb672.exe

IMPHASH b7f39532728ce325dc91e2c72b9d27ee
SHA256 2d073ca86541cb66f339a2966d4ad3216b2fb21cb6018889dabfcf5d8a982e4c
MD5 6318b135503e50e64dd9730a89dcb672
SHA1 c87c028db2ab6b24832a890ab665c822fcf38ace
SHA512 0ec958c3197ae608d0a672715833e0d5b176c33a17315cbf7f30e1cf11b863f05eff929740e64587d574a6dffc9b9c4b5b2497ca392a31e452a646d6ee8738ff
SSDEEP 3072:VJuGnYhTbK80khbOW1oWOQ1f9xHwm1PXBmXZFeA28pMGEdePl9dehiv80P80CnpZ:VJueTk1OwoWOQ3dwaWB28adeP/deUv8M
MD5 SHA1 SHA512 SSDEEP

windows x86

Gh0st RAT payload

Minor OS version

Major OS version

Entry point

20145

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA lstrcmpA SetLastError CopyFileA Process32Next Process32First CreateToolhelp32Snapshot OpenProcess WaitForSingleObject FreeLibrary GetVersion SetFilePointer ReleaseMutex CreateMutexA DeleteFileA GetCurrentThreadId GetFileTime lstrcatA WritePrivateProfileStringA CreateDirectoryA lstrcpyA FreeResource WriteFile SizeofResource LoadResource FindResourceA SetFileTime LocalFileTimeToFileTime LocalReAlloc MultiByteToWideChar CreateFileA ReadFile CloseHandle LocalFree GetTickCount LoadLibraryA Sleep CreateProcessA ExitProcess VirtualAllocEx WriteProcessMemory GetModuleHandleA GetProcAddress CreateRemoteThread GetCurrentProcess GetLastError GetModuleFileNameA lstrlenA LocalAlloc OutputDebugStringA GetSystemDirectoryA GetCommandLineA GetFileAttributesA

user32

CreateWindowExA wsprintfA MessageBoxW CharNextA GetInputState PostThreadMessageA GetMessageA

advapi32

RegOpenKeyExA RegCreateKeyExA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegSetValueExA RegCloseKey OpenServiceA CloseServiceHandle StartServiceA OpenSCManagerA CreateServiceA RegQueryValueExA EnumServicesStatusA QueryServiceConfigA UnlockServiceDatabase ChangeServiceConfigA LockServiceDatabase

shell32

ShellExecuteA

ole32

CoCreateGuid CoInitialize CoUninitialize

msvcrt

free _except_handler3 _strlwr ??1type_info@@UAE@XZ __dllonexit _onexit strstr rename isdigit strtoul strncmp malloc realloc ??3@YAXPAX@Z __CxxFrameHandler ??2@YAPAXI@Z sprintf fclose fwrite fread _stat fopen _snprintf rand wcslen strchr