Overview

overview

10

Static

static

10

v9.5.zip

windows10-1703-x64

10

v9.5.zip

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    v9.5.zip

  • Size

    25.9MB

  • MD5

    5d03d82d8d86aa33d2346eec28991f93

  • SHA1

    09358da590d65bc257f269d5db1f4df860f4c0b3

  • SHA256

    ddf1df18b1d2e12bf8e81c141aef4a9aa66248fb13bb0838cd29ce80ef1d1bbc

  • SHA512

    1cd71233350298b41233ab8b75bacf1a8f1a43ef45f744f56ac9510a56764c405307d0ded503a153952095c04e433bdc5df2d9773d15eac672977e320b76fafc

  • SSDEEP

    786432:iLDtyYd0J2OWU6lOm5bPrArCkYOSWqGhKgYyB:ADtyTJ2OelOmTmLqGhKXyB

Score
10/10
upxgh0strat

Malware Config

Extracted

Family

gh0strat

C2

www.baidu.com

Signatures

  • Gh0st RAT payload 4 IoCs
  • Gh0strat family
    gh0strat
  • ACProtect 1.3x - 1.4x DLL software 15 IoCs

    Detects file using ACProtect software.

  • UPX packed file 18 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 23 IoCs

    Checks for missing Authenticode signature.

Files

  • v9.5.zip
    .zip
  • v9.5/Bin.exe
    .exe windows x86

    fcf1390e9ce472c7270447fc5c61a0c1


    Headers

    Imports

    Sections

  • v9.5/Control/MSTSCAX.DLL
    .dll regsvr32 windows x86


    Headers

    Exports

    Sections

  • v9.5/Control/QQwry.dat
  • v9.5/Control/mstsc.exe
    .exe windows x86


    Headers

    Sections

  • v9.5/Control/upx.exe
    .exe windows x86


    Headers

    Sections

  • v9.5/Dat/dhl.Dat
    .exe windows x86

    4879035e7de03f1ca9ec3aa132c5e034


    Headers

    Imports

    Sections

  • v9.5/Dat/dhl.dll
    .dll windows x86

    2221c0107b5e2205969c1e2018e65d34


    Headers

    Imports

    Exports

    Sections

  • v9.5/Dat/dhl备份.rar
    .rar
  • v9.5/ICO图标/01.ico
  • v9.5/ICO图标/02.ico
  • v9.5/ICO图标/03.ico
  • v9.5/ICO图标/04.ico
  • v9.5/ICO图标/05.ico
  • v9.5/ICO图标/06.ico
  • v9.5/ICO图标/07.ico
  • v9.5/ICO图标/08.ico
  • v9.5/ICO图标/09.ico
  • v9.5/ICO图标/10.ico
  • v9.5/ICO图标/11.ico
  • v9.5/ICO图标/12.ico
  • v9.5/ICO图标/13.ico
  • v9.5/ICO图标/14.ICO
  • v9.5/ICO图标/15.ico
  • v9.5/ICO图标/17.ICO
  • v9.5/ICO图标/18.ico
  • v9.5/ICO图标/24.ico
  • v9.5/ICO图标/28.ico
  • v9.5/ICO图标/29.ico
  • v9.5/ICO图标/30.ico
  • v9.5/ICO图标/32.ico
  • v9.5/ICO图标/36.ico
  • v9.5/ICO图标/39.ico
  • v9.5/Plugins/AnyFileToByte.exe
    .exe windows x86


    Headers

    Sections

  • v9.5/Plugins/CHAT.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/C_CHAT.h
  • v9.5/Plugins/C_C_SERVICE.h
  • v9.5/Plugins/C_FILE.h
  • v9.5/Plugins/C_GETQQ.h
  • v9.5/Plugins/C_KEYLOG.h
  • v9.5/Plugins/C_LISTEN.h
  • v9.5/Plugins/C_PRANK.h
  • v9.5/Plugins/C_PROXY.h
  • v9.5/Plugins/C_PROXYMAP.h
  • v9.5/Plugins/C_REGEDIT.h
  • v9.5/Plugins/C_SCREEN.h
  • v9.5/Plugins/C_SCREEN1.h
  • v9.5/Plugins/C_SERVICE.h
  • v9.5/Plugins/C_SHELL.h
  • v9.5/Plugins/C_SYSTEM.h
  • v9.5/Plugins/C_VIDEO.h
  • v9.5/Plugins/Example.Cpp
  • v9.5/Plugins/FILE.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/KEYLOG.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/LISTEN.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/PRANK.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/PROXY.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/PROXYMAP.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/REGEDIT.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/SCREEN.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/SCREEN1.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/SERVICE.dll
    .dll windows x86

    5eb4b802cdb36a784fa60d6171f5e2a7


    Headers

    Imports

    Exports

    Sections

  • v9.5/Plugins/SHELL.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/SYSTEM.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/UPX压缩.bat
  • v9.5/Plugins/UpdateIP.ini
  • v9.5/Plugins/VIDEO.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/Plugins/upx.exe
    .exe windows x86


    Headers

    Sections

  • v9.5/SkinH.dll
    .dll windows x86


    Headers

    Exports

    Sections

  • v9.5/bin.ini
  • v9.5/使用说明.txt