Behavioral task
behavioral1
Sample
60901b7f42fc6fc450ee0254d7899a48.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
60901b7f42fc6fc450ee0254d7899a48.exe
Resource
win10v2004-20230703-en
General
-
Target
60901b7f42fc6fc450ee0254d7899a48.exe
-
Size
112KB
-
MD5
60901b7f42fc6fc450ee0254d7899a48
-
SHA1
98bfb8b6fda973972782ba977b9baba4c4b1af16
-
SHA256
ec4518d92784b6a06ce8414bc00d8c22d430fddb4b19e8e343cce089db788b45
-
SHA512
df0601ad2a88fa0d00cf90078e44351269defca5ac4087f8a63c67bb5529f2ca0ec12023cd082aa4a6549503f113e27a07d33ee0519bccd2fb174824e1fefeb2
-
SSDEEP
1536:4xkNFnI+WzSkqmG8KBbJs+JJ/PNc1tIfxgexgyR0AEHaQsG:4xMdB9s+z/VWtyxgexgyqAEHzsG
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60901b7f42fc6fc450ee0254d7899a48.exe
Files
-
60901b7f42fc6fc450ee0254d7899a48.exe.exe windows x86
c7e7b8a641518151f1a77de61fdf182d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
DeleteFileA
GetSystemDirectoryA
SetFileAttributesA
MoveFileExA
MoveFileA
GetTickCount
GetTempPathA
GetModuleHandleA
GetDiskFreeSpaceExA
GetDriveTypeA
GlobalMemoryStatus
GetSystemInfo
OpenEventA
CreateMutexA
ExitProcess
CreateDirectoryA
GetCurrentProcess
DefineDosDeviceA
GetCurrentThreadId
lstrcpyW
GlobalMemoryStatusEx
WinExec
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetShortPathNameA
Module32First
CreateRemoteThread
OpenProcess
TerminateProcess
RaiseException
SetPriorityClass
GetCurrentThread
SetThreadPriority
ResumeThread
CreateThread
TerminateThread
GetStartupInfoA
CreateProcessA
GetLastError
SetFilePointer
WriteFile
LocalSize
LocalFree
GetFileAttributesA
CreateFileA
GetFileSize
ReadFile
LocalReAlloc
LocalAlloc
IsBadReadPtr
VirtualProtect
HeapReAlloc
Module32Next
GetEnvironmentVariableA
HeapAlloc
GetProcessHeap
HeapFree
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryA
lstrcpyA
lstrcatA
InitializeCriticalSection
GetPrivateProfileSectionNamesA
lstrlenA
LoadLibraryA
GetProcAddress
FreeLibrary
CancelIo
InterlockedExchange
SetEvent
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
Sleep
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
CopyFileA
user32
ExitWindowsEx
GetWindowTextA
CloseDesktop
SetThreadDesktop
EnumWindows
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
wsprintfA
IsWindowVisible
GetWindowThreadProcessId
SendMessageA
LoadIconA
LoadCursorA
RegisterClassA
GetInputState
PostThreadMessageA
GetMessageA
GetLastInputInfo
MessageBoxA
OpenInputDesktop
gdi32
GetStockObject
advapi32
RegCreateKeyA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
OpenSCManagerA
OpenServiceA
DeleteService
RegSetValueExA
RegCloseKey
OpenEventLogA
ClearEventLogA
CloseEventLog
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
IsValidSid
SetServiceStatus
RegisterServiceCtrlHandlerA
CreateProcessAsUserA
SetTokenInformation
DuplicateTokenEx
OpenProcessToken
StartServiceCtrlDispatcherA
CloseServiceHandle
StartServiceA
UnlockServiceDatabase
ChangeServiceConfig2A
LockServiceDatabase
CreateServiceA
ControlService
QueryServiceStatus
AbortSystemShutdownA
GetUserNameA
LookupAccountSidA
GetTokenInformation
RegOpenKeyA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
msvcrt
_mbsstr
_strnicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
??1type_info@@UAE@XZ
_iob
_onexit
__dllonexit
calloc
_snprintf
_beginthreadex
atol
_mbscmp
_strcmpi
sprintf
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
__CxxFrameHandler
??2@YAPAXI@Z
strchr
malloc
puts
strrchr
exit
_except_handler3
strncat
realloc
free
atoi
rand
strncmp
strncpy
_errno
mbstowcs
wcslen
wcstombs
wcscpy
_CxxThrowException
urlmon
URLDownloadToFileA
wininet
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
InternetReadFile
iphlpapi
GetIfTable
wtsapi32
WTSQuerySessionInformationA
WTSFreeMemory
WTSQuerySessionInformationW
WTSEnumerateSessionsA
WTSLogoffSession
WTSDisconnectSession
netapi32
NetUserSetInfo
NetUserDel
NetUserGetLocalGroups
NetApiBufferFree
NetUserGetInfo
NetUserEnum
NetLocalGroupAddMembers
NetUserAdd
psapi
EnumProcessModules
GetModuleFileNameExA
Sections
.text Size: 80KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ