gh0strat | 071a3dc2ea49bc6d64b411fdc5c582a2

Sharing

Copy URL Twitter E-mail

General

Target

071a3dc2ea49bc6d64b411fdc5c582a2
Size

152KB
MD5

071a3dc2ea49bc6d64b411fdc5c582a2
SHA1

df16f8f2e094871447e896da3f3d988f143bf188
SHA256

cb758ae040ebda9e2beaa2d3ec988e17ca273bb05c0c8802e314baa3d0248462
SHA512

1cd1260147277a24e2ea3b59618f1c59e6de0d305fdfb9d74c75a462fbc5498f1b554fed9ae5eff23bab838f75c7d73f6409054e3c9d3ae196de973fa9a34fa2
SSDEEP

3072:YwNQfsuUdCj6SVpbsUu76kxDLZ8EvKfxK6TBftcG0ANMg3:gkHCjneU7kBZ8+KfM6TBlcGH

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
071a3dc2ea49bc6d64b411fdc5c582a2

Files

071a3dc2ea49bc6d64b411fdc5c582a2
.dll windows:4 windows x86 arch:x86

aec0f2d09bc4970bcb71ac4cee96e990

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
CloseHandle
lstrlenA
lstrcatA
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
MapViewOfFile
GetLastError
CreateFileMappingA
HeapAlloc
lstrcpyA
LocalFree
LocalAlloc
InterlockedExchange
Sleep
GetSystemInfo
GetVersionExA
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
FreeLibrary
GlobalFree
GlobalAlloc
GetProcAddress
GetModuleHandleA
GetTempFileNameA
GetSystemDirectoryA
VirtualFree
DeleteFileA
RemoveDirectoryA
ExitThread
GetShortPathNameA
GetModuleFileNameA
IsBadReadPtr
IsBadStringPtrW
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
lstrcmpiA
ExpandEnvironmentStringsA
InitializeCriticalSection
LeaveCriticalSection
LocalSize
LocalReAlloc
VirtualAlloc
VirtualQuery
GetCurrentProcessId
GetCurrentThreadId
GetFileAttributesExA
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
ExitProcess
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
RaiseException
LoadLibraryA

oleaut32

SysFreeString

user32

wvsprintfA
MessageBoxA
CloseWindowStation
EnableWindow
ShowWindow
GetWindow
GetClassNameA
DestroyWindow
CreateWindowExA
GetWindowRect
GetCursorInfo
DestroyCursor
LoadCursorA
wsprintfA

shlwapi

StrStrIA

userenv

GetProfilesDirectoryA
GetUserProfileDirectoryA

ws2_32

shutdown
send
closesocket
select
socket
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
getsockname
gethostname
recv
gethostbyname

iphlpapi

GetAdaptersInfo

msvcrt

_strlwr
strstr
_ftol
srand
rand
strchr
atoi
strncpy
_except_handler3
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_CxxThrowException
memmove
ceil
wcslen
realloc
malloc
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_memicmp
_strupr
_stricmp
wcstombs
_wcsicmp
_beginthreadex
wcsrchr
strncat
strrchr
free

Exports

Exports

DhcpAcquireParameters
DhcpAcquireParametersByBroadcast
DhcpCApiCleanup
DhcpCApiInitialize
DhcpDeRegisterOptions
DhcpDeRegisterParamChange
DhcpDelPersistentRequestParams
DhcpEnumClasses
DhcpFallbackRefreshParams
DhcpHandlePnPEvent
DhcpLeaseIpAddress
DhcpLeaseIpAddressEx
DhcpNotifyConfigChange
DhcpNotifyConfigChangeEx
DhcpNotifyMediaReconnected
DhcpOpenGlobalEvent
DhcpPersistentRequestParams
DhcpRegisterOptions
DhcpRegisterParamChange
DhcpReleaseIpAddressLease
DhcpReleaseIpAddressLeaseEx
DhcpReleaseParameters
DhcpRemoveDNSRegistrations
DhcpRenewIpAddressLease
DhcpRenewIpAddressLeaseEx
DhcpRequestOptions
DhcpRequestParams
DhcpStaticRefreshParams
DhcpUndoRequestParams
McastApiCleanup
McastApiStartup
McastEnumerateScopes
McastGenUID
McastReleaseAddress
McastRenewAddress

Sections

.text
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aec0f2d09bc4970bcb71ac4cee96e990

Headers

File Characteristics

Imports

kernel32

oleaut32

user32

shlwapi

userenv

ws2_32

iphlpapi

msvcrt

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 96KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 96KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB