gh0strat | 70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3

Sharing

Copy URL Twitter E-mail

General

Target
70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3
Size 51KB
Sample231009-ry2g4sde2w
SHA256 70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3
MD5 13111c097548256c90a00bf9bbe1b295
SHA1 e480233581a33037a79497cde3ee205b37e2177c
SHA512 f14f9c7cb4af02394474ee94a1d25462a16a35fcbf7ff6268ccf321273154de0c1212dda692a54bee9bb58f544d3ec90caf1066ddfd1d73711372202f0c4c9ea
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLUJYH5:1dWubF3n9S91BF3fbowJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3

File Explorer

70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3

.dll 51KB

70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3

IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
SHA256 70bc11395a5687494bad7a68186cc854a541fcda36fca28dccc24104bc39fac3
MD5 13111c097548256c90a00bf9bbe1b295
SHA1 e480233581a33037a79497cde3ee205b37e2177c
SHA512 f14f9c7cb4af02394474ee94a1d25462a16a35fcbf7ff6268ccf321273154de0c1212dda692a54bee9bb58f544d3ec90caf1066ddfd1d73711372202f0c4c9ea
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLUJYH5:1dWubF3n9S91BF3fbowJYH5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrlenA lstrcpyA FreeLibrary GetProcAddress LoadLibraryA GetTickCount WinExec ReadFile GetFileAttributesA LocalFree LocalSize LocalAlloc lstrcatA GetCurrentProcessId Process32Next TerminateProcess OpenProcess Process32First CopyFileA GetModuleFileNameA GetLastError WaitForSingleObject CreateProcessA GetCurrentDirectoryA FreeConsole GetModuleHandleA HeapAlloc GetProcessHeap VirtualProtect HeapFree InitializeCriticalSection DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection SetEvent CreateEventA WritePrivateProfileStringA GetSystemDirectoryA GetPrivateProfileStringA lstrcmpiA GetFileSize CreateFileA SetFilePointer WriteFile CloseHandle Sleep InterlockedExchange VirtualAlloc GlobalMemoryStatusEx VirtualFree

user32

GetWindowThreadProcessId GetLastInputInfo wsprintfA ChangeDisplaySettingsA GetSystemMetrics

advapi32

RegQueryValueA RegSetValueExA RegCloseKey CloseServiceHandle ControlService QueryServiceStatus OpenServiceA OpenSCManagerA RegOpenKeyExA

shell32

SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit

mfc42

ord825 ord823

msvcrt

_strupr _strcmpi _stricmp _strnicmp _onexit ??1type_info@@UAE@XZ _beginthreadex _errno realloc strchr _adjust_fdiv __dllonexit _initterm ceil _ftol __CxxFrameHandler _CxxThrowException _except_handler3 _local_unwind2 rand strstr strncpy strrchr free malloc printf atoi strcspn wcstombs

urlmon

URLDownloadToFileA

ws2_32

connect inet_addr getsockname WSAStartup WSACleanup closesocket ntohs listen bind socket accept htons gethostbyname sendto recvfrom __WSAFDIsSet select send recv getpeername inet_ntoa

iphlpapi

GetIfTable GetAdaptersInfo