gh0strat | 0804dffae038547e0e0c8d8eed545200

Sharing

Copy URL Twitter E-mail

General

Target

0804dffae038547e0e0c8d8eed545200
Size

140KB
MD5

0804dffae038547e0e0c8d8eed545200
SHA1

3d8b91dc96a8d03cd344e5492aa0891688d3b9a6
SHA256

0e273b12dc89bcbee8c0e3fed45c1915b64c2d751b7aa83c4e3a50cc9d776945
SHA512

d5da205c3e6027b4a18b00f90036eed05fce7d5620a368e1ff19bf8b43419a410489b4f8e6bca4f428319d6107540b8ccea5bd0d80b59ae9d84c9c7e6caab1e2
SSDEEP

3072:T76RnnvIStWq73hGUmv06+W5/RaVJ1xd3kV1/:T76RnnvIStWqz8UmMi5ZMJ1Ib

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

0804dffae038547e0e0c8d8eed545200
.exe windows:4 windows x86 arch:x86

53282eb893934c63dfc3cc7bccfb118f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:ad:ad:20:cc:bc:17:01:64:bd:ec:8f:bc:a0:69:24
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/05/2011, 00:00

Not After

22/05/2012, 23:59

Subject

CN=AhnLab\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=AhnLab\, Inc.,L=Yeongdeungpo-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

eb:7e:bc:28:ef:4c:fe:52:27:be:75:a0:fe:ac:b2:bf:3b:20:91:4d
Signer

Actual PE Digest

eb:7e:bc:28:ef:4c:fe:52:27:be:75:a0:fe:ac:b2:bf:3b:20:91:4d

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetUnhandledExceptionFilter
ReleaseMutex
CreateMutexA
GetCommandLineA
SetFileAttributesA
CreateDirectoryA
GetModuleFileNameA
GetStartupInfoA
GetModuleHandleA
SetFilePointer
ReadFile
GetSystemDirectoryA
GetTickCount
GetFileAttributesA
Sleep
lstrcatA
GetLastError
SetLastError
GetWindowsDirectoryA
lstrcmpiA
lstrcpyA
FindResourceA
LoadResource
CreateFileA
lstrlenA
WriteFile
CloseHandle
FreeResource
LoadLibraryA
GetProcAddress
ExitProcess

user32

wsprintfA

advapi32

RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
OpenServiceA
StartServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA

msvcrt

strtok
??2@YAPAXI@Z
strchr
__CxxFrameHandler
_CxxThrowException
realloc
malloc
??3@YAXPAX@Z
strstr
_except_handler3
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

Sections

A6Li
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 117KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

53282eb893934c63dfc3cc7bccfb118f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2b:ad:ad:20:cc:bc:17:01:64:bd:ec:8f:bc:a0:69:24Certificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

eb:7e:bc:28:ef:4c:fe:52:27:be:75:a0:fe:ac:b2:bf:3b:20:91:4dSigner

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcrt

Sections

A6Li Size: 3KB - Virtual size: 2KB

.text Size: 4KB - Virtual size: 4KB

.rsrc Size: 117KB - Virtual size: 120KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2b:ad:ad:20:cc:bc:17:01:64:bd:ec:8f:bc:a0:69:24
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

eb:7e:bc:28:ef:4c:fe:52:27:be:75:a0:fe:ac:b2:bf:3b:20:91:4d
Signer

A6Li
Size: 3KB - Virtual size: 2KB

.text
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 117KB - Virtual size: 120KB