Shellex
Behavioral task
behavioral1
Sample
f9fe02ecceb36ac39690656b1a874fc45e0d05a044069641e5fb233c4d540ece.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
f9fe02ecceb36ac39690656b1a874fc45e0d05a044069641e5fb233c4d540ece.dll
Resource
win10v2004-20230831-en
General
-
Target
f9fe02ecceb36ac39690656b1a874fc45e0d05a044069641e5fb233c4d540ece
-
Size
36KB
-
MD5
e7122999ffcf0d5cfa1b6fb78706218f
-
SHA1
972dc4a8c9c3890c9836e2d7b5457443d415ed37
-
SHA256
f9fe02ecceb36ac39690656b1a874fc45e0d05a044069641e5fb233c4d540ece
-
SHA512
260a889fea78b135ed330742620222161774317ba0ae8bc3efd5bf33ecb914458ec393eb380a4bc6bf72159f486c60f9518030255b31837eac3379f93b1f7fd1
-
SSDEEP
384:IsHv1ZZTWl6mfXX7qq3tLH8fiUnOossl9XQH6DgBVCwWOJW2:dBTAHfH7qK8fij5MQzVCc
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9fe02ecceb36ac39690656b1a874fc45e0d05a044069641e5fb233c4d540ece
Files
-
f9fe02ecceb36ac39690656b1a874fc45e0d05a044069641e5fb233c4d540ece.dll windows x86
5dc0315e0770b6d70c17c01af1df358d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ws2_32
getsockname
gethostname
send
closesocket
recv
select
socket
gethostbyname
htons
connect
setsockopt
WSACleanup
WSAIoctl
WSAStartup
msvcrt
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_beginthreadex
malloc
sprintf
strchr
strncat
_except_handler3
free
realloc
strrchr
strncpy
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
strstr
_ftol
ceil
memmove
??3@YAXPAX@Z
_stricmp
_strnicmp
kernel32
DisableThreadLibraryCalls
CreateFileA
WriteFile
GetCurrentThreadId
SetErrorMode
GetTickCount
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent
SetEvent
InterlockedExchange
CancelIo
Sleep
GetLastError
GetFileAttributesA
CreateProcessA
lstrcpyA
lstrcatA
ExpandEnvironmentStringsA
lstrlenA
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetVersionExA
HeapAlloc
GetProcessHeap
VirtualProtect
IsBadReadPtr
HeapFree
Process32Next
Process32First
GetLocalTime
GetSystemInfo
GetDiskFreeSpaceExA
GetDriveTypeA
GlobalMemoryStatusEx
TerminateThread
user32
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
ExitWindowsEx
wsprintfA
advapi32
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegQueryValueA
RegCloseKey
OpenProcessToken
RegEnumValueA
Exports
Exports
Sections
.text Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ