gh0strat | 1196-55-0x0000000010000000-0x0000000010015000-memory[.]dmp

Sharing

Copy URL Twitter E-mail

General

Target
1196-55-0x0000000010000000-0x0000000010015000-memory.dmp
Size 84KB
Sample230816-d81fxagh5y
SHA256 fa0ace34094dc01a32f7c31b70d66ef7ae482b06e7232f8f12100c9a03877a2c
MD5 d18cc2c43e8d5507bf66585033152135
SHA1 7f758b0e77e59d35d27e0eb2f96dce1d9844813e
SHA512 344c62c69f7e6dcd64ac5a246e62f3b0659f4e8a3ced6ca504d118c56de8f68791ca651d628d7d7b3e3ad05a415ba66a645508ad3d76a178103ae635c4a5e124
SSDEEP 1536:iTsenhY8kwtuwL7hSm1RheIOdnToIfAUfeeGHE:SsEY8mwnhSHVTBfAUfgHE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Extracted

Family

gh0strat

156.236.72.163

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1196-55-0x0000000010000000-0x0000000010015000-memory.dmp

File Explorer

1196-55-0x0000000010000000-0x0000000010015000-memory.dmp

.dll 84KB

1196-55-0x0000000010000000-0x0000000010015000-memory.dmp

IMPHASH 2221c0107b5e2205969c1e2018e65d34
SHA256 fa0ace34094dc01a32f7c31b70d66ef7ae482b06e7232f8f12100c9a03877a2c
MD5 d18cc2c43e8d5507bf66585033152135
SHA1 7f758b0e77e59d35d27e0eb2f96dce1d9844813e
SHA512 344c62c69f7e6dcd64ac5a246e62f3b0659f4e8a3ced6ca504d118c56de8f68791ca651d628d7d7b3e3ad05a415ba66a645508ad3d76a178103ae635c4a5e124
SSDEEP 1536:iTsenhY8kwtuwL7hSm1RheIOdnToIfAUfeeGHE:SsEY8mwnhSHVTBfAUfgHE
MD5 SHA1 SHA512 SSDEEP

windows x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

47281

Magic Number

267

Subsystem

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcatA CopyFileA GetModuleFileNameA CreateProcessA ExpandEnvironmentStringsA lstrcpyA FreeLibrary GetProcAddress LoadLibraryA TerminateThread ResumeThread SetThreadPriority GetCurrentThread SetPriorityClass GetEnvironmentVariableA GetShortPathNameA DeleteFileA GetTickCount LocalAlloc ReadFile HeapAlloc GetProcessHeap VirtualProtect HeapFree GetSystemInfo lstrcmpiA GetLocalTime GetDiskFreeSpaceExA GetDriveTypeA GlobalMemoryStatusEx GetVersionExA WinExec GetFileAttributesA CreateDirectoryA ReleaseMutex CreateMutexA MoveFileExA MoveFileA SetFileAttributesA Process32Next Process32First OutputDebugStringA CreateThread ExitProcess GetCurrentProcessId GetCurrentThreadId GetSystemDirectoryA GetFileSize SetFilePointer lstrlenA CancelIo InterlockedExchange SetEvent ResetEvent WaitForSingleObject CreateEventA GlobalAlloc GetLastError LocalFree SetLastError CreateFileA DeviceIoControl WriteFile CloseHandle Sleep GetVersion GetCurrentProcess FindFirstFileA VirtualFree FindNextFileA GlobalLock GlobalUnlock VirtualAlloc LoadLibraryW

user32

GetMessageA EnumWindows IsWindowVisible SendMessageA MessageBoxA GetKeyState GetAsyncKeyState GetForegroundWindow PostThreadMessageA GetInputState GetLastInputInfo SetClipboardData CloseClipboard GetClipboardData OpenClipboard ExitWindowsEx EmptyClipboard wsprintfA GetWindowTextA

advapi32

OpenProcessToken CloseEventLog RegOpenKeyExA RegSetValueExA RegCloseKey LookupPrivilegeValueA AdjustTokenPrivileges OpenEventLogA DeleteService OpenServiceA OpenSCManagerA RegQueryValueExA RegOpenKeyA RegQueryValueA CreateProcessAsUserA SetTokenInformation DuplicateTokenEx SetServiceStatus RegisterServiceCtrlHandlerA StartServiceCtrlDispatcherA CloseServiceHandle StartServiceA UnlockServiceDatabase ChangeServiceConfig2A LockServiceDatabase CreateServiceA ClearEventLogA

shell32

SHGetSpecialFolderPathA ShellExecuteExA SHChangeNotify

ole32

CoInitialize CoUninitialize CoCreateGuid

ws2_32

socket getsockname gethostname send WSAStartup WSACleanup WSAIoctl setsockopt connect htons gethostbyname select recv closesocket

msvcrt

_strcmpi _CxxThrowException _adjust_fdiv _initterm ??1type_info@@UAE@XZ _beginthreadex _except_handler3 strncmp sprintf _stricmp _snprintf printf strcspn strncpy atoi _access strrchr malloc free realloc rand strstr _strupr ??2@YAPAXI@Z exit __CxxFrameHandler _ftol ??3@YAXPAX@Z

setupapi

SetupDiEnumDeviceInfo SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA SetupDiSetClassInstallParamsA

iphlpapi

GetIfTable

urlmon

URLDownloadToFileA