gh0strat | e1dadaf4f74558699ec060508af6e99ed2ea7a54edd3997d81cabd52dd752d93

Sharing

Copy URL Twitter E-mail

General

Target

e1dadaf4f74558699ec060508af6e99ed2ea7a54edd3997d81cabd52dd752d93
Size

2.9MB
MD5

829fd1ec3fd8dec53e50d08e8dc8ef27
SHA1

3f7906f13a2a894a108029771ece8d96e967d0d4
SHA256

e1dadaf4f74558699ec060508af6e99ed2ea7a54edd3997d81cabd52dd752d93
SHA512

39e7dee7d6ddeccee4bc4d79b06a27c7118f850992eeb90ab624c5d09233e1ec2722cee2b82755891920154284ead528ecc3f9792074792e6b69d7645a61fd94
SSDEEP

24576:m75IGJrwUGBcTESiW+LV6EgFjeaQLI8QhzpbxaLsWN57SxnnxoEFAnanmBmVlXVT:meBW8Qhdt6RAU9Bo1CnfaJe/TcbLs4

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1dadaf4f74558699ec060508af6e99ed2ea7a54edd3997d81cabd52dd752d93

Files

e1dadaf4f74558699ec060508af6e99ed2ea7a54edd3997d81cabd52dd752d93
.exe windows x86

165328df14f8d305b9020825005dc441

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHAutoComplete
PathRemoveFileSpecA

kernel32

GetStringTypeW
SetConsoleCtrlHandler
IsBadReadPtr
IsBadCodePtr
IsValidLocale
IsValidCodePage
EnumSystemLocalesA
GetUserDefaultLCID
SetStdHandle
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableA
CreateThread
WaitForSingleObject
Sleep
LCMapStringW
LCMapStringA
GetProfileStringA
VirtualFree
GetFileType
VirtualAlloc
CloseHandle
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
ReadFile
GetFileSize
DeleteFileA
CreateFileA
OutputDebugStringA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
FatalAppExitA
FindClose
FindFirstFileA
CopyFileA
GetModuleFileNameA
GetTickCount
lstrlenA
GetDriveTypeA
GetDiskFreeSpaceExA
GetLogicalDriveStringsA
GetFileAttributesA
LocalFree
LocalAlloc
FindNextFileA
WriteFile
SetFilePointer
RemoveDirectoryA
MoveFileA
GetLastError
CreateDirectoryA
lstrcpyA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
lstrcatA
GetProcAddress
LoadLibraryA
SetUnhandledExceptionFilter
GetLocalTime
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
PostQueuedCompletionStatus
EnterCriticalSection
GetSystemInfo
CreateIoCompletionPort
InterlockedDecrement
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
HeapSize
HeapReAlloc
TerminateProcess
GetSystemTime
GetTimeZoneInformation
GetACP
ExitProcess
GetCommandLineA
GetStartupInfoA
RaiseException
ExitThread
HeapFree
HeapAlloc
RtlUnwind
lstrcpyW
FindResourceExA
SetErrorMode
GetProcessVersion
GlobalFlags
WaitForMultipleObjects
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
VirtualProtect
SystemTimeToFileTime
LocalFileTimeToFileTime
GetProfileIntA
TlsGetValue
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
GetDiskFreeSpaceA
GetFileTime
SetFileTime
SuspendThread
GetCurrentThread
SetLastError
GetShortPathNameA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
GetVolumeInformationA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
DuplicateHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenW
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpiA
lstrcpynA
FormatMessageA
CompareStringA
GetTempPathA
GetTempFileNameA
GetPrivateProfileSectionNamesA
lstrcmpA
EnumResourceLanguagesA
EnumResourceTypesA
MultiByteToWideChar
WideCharToMultiByte
EnumResourceNamesA
SetFileAttributesA
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
GetExitCodeThread
SetThreadPriority
ResetEvent
GetModuleHandleA
GetOEMCP
GetCPInfo
GetVersionExA
FreeLibrary
GetCurrentDirectoryA
SizeofResource
InterlockedIncrement
MulDiv
FindResourceA
LoadResource
LockResource
ResumeThread
TerminateThread
GetVersion
LocalSize
LocalReAlloc
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetSystemDirectoryA
DeleteCriticalSection
CancelIo
InterlockedExchange
SetEvent
GetQueuedCompletionStatus
GetStringTypeA

user32

WindowFromDC
PostThreadMessageA
GetWindowThreadProcessId
GetNextDlgGroupItem
MsgWaitForMultipleObjects
CreateMenu
RemoveMenu
InSendMessage
DrawMenuBar
TranslateMDISysAccel
DefFrameProcA
LoadStringA
EndPaint
BeginPaint
GetWindowDC
UnpackDDElParam
ReuseDDElParam
TranslateAcceleratorA
SetWindowContextHelpId
ValidateRect
ShowOwnedPopups
PostQuitMessage
DestroyMenu
wvsprintfA
OemToCharA
CharToOemA
GetMenuCheckMarkDimensions
ModifyMenuA
SetMenuItemBitmaps
SetWindowTextA
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
SendDlgItemMessageA
ScrollWindow
SetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
WinHelpA
GetClassInfoA
RegisterClassA
SetWindowPlacement
CreateWindowExA
SetPropA
GetPropA
RemovePropA
GetMessageTime
GetMessagePos
GetWindowPlacement
EndDialog
CreateDialogIndirectParamA
GetTabbedTextExtentA
DestroyWindow
GetClipboardFormatNameA
GetAsyncKeyState
MapDialogRect
SendMessageTimeoutA
UnionRect
GetMenu
SetMenu
CallWindowProcA
IsWindowUnicode
GetWindowLongW
SetWindowLongW
GetScrollInfo
GetDoubleClickTime
SetCursorPos
GetClassLongA
AdjustWindowRectEx
SetWindowRgn
GetCursor
LoadMenuIndirectA
GetMenuStringW
LookupIconIdFromDirectoryEx
CopyImage
BeginDeferWindowPos
EndDeferWindowPos
DeferWindowPos
CharUpperA
GetKeyboardLayoutList
GetKeyboardState
ToAsciiEx
GetKeyboardLayout
MapVirtualKeyExA
GetKeyNameTextA
IsCharLowerA
IsIconic
LoadAcceleratorsA
CopyAcceleratorTableA
IsWindowEnabled
GetActiveWindow
GetWindowTextLengthA
GetWindowTextA
DefWindowProcA
GetDialogBaseUnits
DrawFrameControl
InsertMenuA
BringWindowToTop
SetActiveWindow
DrawAnimatedRects
SetParent
FindWindowA
EnumChildWindows
DrawFocusRect
MoveWindow
LoadIconA
SendMessageA
EnableWindow
RegisterWindowMessageA
SetRect
UnregisterClassA
ExcludeUpdateRgn
DefDlgProcA
wsprintfA
LoadImageA
GetWindow
GetClientRect
MapWindowPoints
SetFocus
EqualRect
GetClassNameA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
ShowWindow
IsDialogMessageA
IsClipboardFormatAvailable
GetMenuStringA
GetDlgItem
WaitMessage
GetTopWindow
GetWindowRgn
GetDlgCtrlID
HideCaret
ShowCaret
IsChild
MapVirtualKeyA
IsMenu
LoadBitmapA
GrayStringA
TabbedTextOutA
DestroyIcon
CopyIcon
CreateIconIndirect
CreateIconFromResourceEx
RegisterClipboardFormatA
SystemParametersInfoA
GetMenuDefaultItem
LockWindowUpdate
GetDCEx
InvertRect
GetMenuItemInfoA
DrawEdge
GetNextDlgTabItem
CopyRect
GetForegroundWindow
GetLastActivePopup
SetWindowLongA
IsZoomed
SetWindowPos
GetWindowLongA
PeekMessageA
IsRectEmpty
DrawStateA
SetRectEmpty
GetSysColorBrush
FillRect
GetCapture
GetSysColor
GetMessageA
TranslateMessage
PostMessageA
SetCapture
LoadCursorA
SetCursor
ScreenToClient
UpdateWindow
WindowFromPoint
ClientToScreen
ReleaseCapture
GetParent
IsWindowVisible
MessageBoxA
GetFocus
GetCursorPos
GetMenuItemCount
EnableMenuItem
DeleteMenu
DefMDIChildProcA
GetSubMenu
LoadMenuA
CharNextA
PtInRect
GetWindowRect
CheckMenuItem
AppendMenuA
CreatePopupMenu
RedrawWindow
GetDesktopWindow
OffsetRect
GetSystemMetrics
InflateRect
MessageBeep
GetSystemMenu
SetTimer
KillTimer
DestroyCursor
SetClassLongA
ReleaseDC
GetDC
GetIconInfo
CheckMenuRadioItem
IntersectRect
DrawIconEx
ShowScrollBar
GetMenuState
DrawTextA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetKeyState
InvalidateRect
IsWindow
GetMenuItemID
TrackPopupMenu
SetForegroundWindow
SetMenuDefaultItem
DispatchMessageA

gdi32

OffsetViewportOrgEx
GetClipBox
GetTextExtentPoint32W
ExtTextOutW
GetCharWidthA
GetCurrentPositionEx
IntersectClipRect
GetClipRgn
ExtSelectClipRgn
GetDCOrgEx
StartDocA
SaveDC
RestoreDC
SelectPalette
SetPolyFillMode
SetROP2
SetMapMode
SetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
OffsetClipRgn
SetTextAlign
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
ArcTo
SetArcDirection
PolyDraw
PolylineTo
SetColorAdjustment
SelectClipPath
ExtCreateRegion
GetObjectType
EnumMetaFile
PlayMetaFile
ExtCreatePen
CreateHatchBrush
CreateDIBPatternBrushPt
BeginPath
SetRectRgn
DPtoLP
CopyMetaFileA
CreateDCA
LPtoDP
AbortDoc
EndDoc
EndPage
StartPage
SetAbortProc
DeleteMetaFile
CloseMetaFile
CreateMetaFileA
GetBitmapBits
EnumFontFamiliesExA
CreatePen
GetCurrentObject
GetWindowOrgEx
CreateRectRgnIndirect
GetTextColor
GetStockObject
CreateRectRgn
PtInRegion
PatBlt
GetPixel
SetPixel
GetDIBits
Escape
RectVisible
PtVisible
CreateFontIndirectA
GetTextExtentPoint32A
GetTextAlign
Polygon
GetTextMetricsA
SetBkMode
DeleteObject
SelectObject
CreateDIBSection
CreateCompatibleDC
StretchDIBits
BitBlt
ExtTextOutA
PolyBezierTo
LineTo
MoveToEx
CloseFigure
EndPath
StrokeAndFillPath
FillPath
StrokePath
GetWindowExtEx
GetViewportExtEx
SetBrushOrgEx
Ellipse
ExtFloodFill
RoundRect
CreatePolygonRgn
GetRgnBox
Rectangle
CombineRgn
GetViewportOrgEx
Polyline
CreateFontA
GetBkColor
GetMapMode
CreatePatternBrush
SetTextColor
SetBkColor
GetDeviceCaps
SetStretchBltMode
CreateCompatibleBitmap
DeleteDC
CreateBitmap
CreateSolidBrush
TextOutA
GetObjectA
PlayMetaFileRecord
GetTextExtentPointA
CreateDIBitmap
StretchBlt

comdlg32

PrintDlgA
PageSetupDlgA
ChooseColorA
CommDlgExtendedError
GetOpenFileNameA
GetSaveFileNameA
GetFileTitleA

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

SetFileSecurityA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumValueA
RegCreateKeyA
RegSetValueA
GetFileSecurityA
RegCloseKey
RegEnumKeyA
RegQueryValueA
RegOpenKeyA
RegEnumKeyExA

shell32

ord71
ExtractIconA
Shell_NotifyIconA
SHAppBarMessage
SHGetPathFromIDListA
ShellExecuteA
SHGetMalloc
DragAcceptFiles
DragFinish
DragQueryFileA
SHGetFileInfoA
SHGetSpecialFolderLocation

comctl32

DestroyPropertySheetPage
PropertySheetA
ImageList_Write
ImageList_Read
ImageList_Merge
ImageList_LoadImageA
ord14
ord13
ord17
ImageList_Remove
ImageList_Draw
ImageList_Create
ImageList_GetImageInfo
ImageList_Add
ImageList_GetIcon
ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Destroy
_TrackMouseEvent
ImageList_AddMasked
ImageList_ReplaceIcon
CreatePropertySheetPageA

oledlg

ord8
ord4
ord9
ord5
ord1
ord3
ord7
ord6

ole32

CoTaskMemFree
ReleaseStgMedium
OleGetClipboard
OleDuplicateData
CreateBindCtx
SetConvertStg
WriteFmtUserTypeStg
WriteClassStg
OleRegGetUserType
ReadFmtUserTypeStg
ReadClassStg
StringFromCLSID
OleSave
CoTreatAsClass
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleQueryCreateFromData
OleQueryLinkFromData
CreateFileMoniker
OleIsRunning
CreateItemMoniker
CreateGenericComposite
GetClassFile
OleLockRunning
OleSetContainedObject
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateFromFile
OleCreateLinkToFile
OleCreate
GetRunningObjectTable
IsAccelerator
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
OleRun
OleUninitialize
OleInitialize
CoUninitialize
CoInitialize
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CreateStreamOnHGlobal
OleLoad
OleTranslateAccelerator
CreateDataAdviseHolder
OleRegGetMiscStatus
CreateOleAdviseHolder
OleRegEnumVerbs
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoGetMalloc
CoRevokeClassObject
CoRegisterClassObject
CoRegisterMessageFilter
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
CoFreeUnusedLibraries
OleSetMenuDescriptor
OleSaveToStream
WriteClassStm
OleGetIconOfClass
GetHGlobalFromILockBytes
CoTaskMemAlloc
CoDisconnectObject

olepro32

ord253

oleaut32

SafeArrayCreate
SafeArrayRedim
VariantCopy
SysAllocStringByteLen
VariantChangeType
SysStringByteLen
VarCyFromStr
VarBstrFromCy
VarDateFromStr
VarBstrFromDate
SafeArrayCopy
SafeArrayAllocData
SafeArrayAllocDescriptor
SafeArrayGetDim
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SysAllocStringLen
SysReAllocStringLen
VariantTimeToSystemTime
SysStringLen
LoadTypeLi
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
VariantChangeTypeEx
VariantClear
SysFreeString
OleLoadPicturePath
SafeArrayGetElement
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SysAllocString
VariantInit

dbghelp

MiniDumpWriteDump

ws2_32

getsockname
ntohs
inet_addr
recv
__WSAFDIsSet
send
WSAIoctl
WSACloseEvent
setsockopt
WSASend
WSARecv
accept
WSAGetLastError
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSASocketA
WSACreateEvent
WSAEventSelect
bind
listen
gethostname
WSAStartup
ioctlsocket
gethostbyname
htons
connect
select
WSACleanup
closesocket
getpeername
inet_ntoa
socket

avifil32

AVIFileExit
AVIStreamSetFormat
AVIFileCreateStreamA
AVIFileOpenA
AVIStreamWrite
AVIStreamRelease
AVIFileRelease
AVIFileInit

msvfw32

DrawDibDraw
ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICOpen
ICSendMessage
ICSeqCompressFrameStart
ICDecompress
DrawDibOpen
DrawDibClose

winmm

PlaySoundA
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveInStart
waveOutWrite
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutReset
waveOutUnprepareHeader
waveOutClose

pdh

PdhCollectQueryData
PdhGetFormattedCounterValue
PdhOpenQueryA
PdhAddCounterA
PdhCloseQuery

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 336KB - Virtual size: 332KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 448KB - Virtual size: 478KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

165328df14f8d305b9020825005dc441

Headers

File Characteristics

Imports

shlwapi

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

dbghelp

ws2_32

avifil32

msvfw32

winmm

pdh

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 336KB - Virtual size: 332KB

.data Size: 448KB - Virtual size: 478KB

.rsrc Size: 220KB - Virtual size: 219KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 336KB - Virtual size: 332KB

.data
Size: 448KB - Virtual size: 478KB

.rsrc
Size: 220KB - Virtual size: 219KB