gh0strat | 1d53468c83ba885eaeb72fd9d779dab7

General

Target

1d53468c83ba885eaeb72fd9d779dab7
Size

92KB
MD5

1d53468c83ba885eaeb72fd9d779dab7
SHA1

36ab65daa95c8eaa036e14758a7387465b807fce
SHA256

cd21fff8b5b81137bbb071fed09a1d37cad16a1cd339847f21e951fd8a463a82
SHA512

bea6ecc5bf2ad67763c249e64f5164fb24e92f4f4e1daf6336ad429de53b07f880cb0de25303513e59cf0e6fd438ef0aabee40ca8d20239d407af2251414be8d
SSDEEP

1536:cXKUask2h8qOdYqLDfhjw1qcpuufa3sDeOgbxewmw5QI:9UaskBYkDfNw1q2uoa3sKOYewmw5QI

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d53468c83ba885eaeb72fd9d779dab7

Files

1d53468c83ba885eaeb72fd9d779dab7
.exe windows:4 windows x86 arch:x86

329471665f5c4c5f677765b61d503254

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
lstrlenA
LoadLibraryA
MoveFileExA
DeleteFileA
FreeResource
GetSystemDirectoryA
CreateFileA
GlobalAlloc
lstrcpyA
lstrcmpiA
SetLastError
LoadResource
FindResourceA
SizeofResource
Sleep
ExitProcess
CreateThread
VirtualAlloc
CloseHandle
VirtualAllocEx
VirtualProtectEx
GetModuleHandleA
GetProcAddress
WriteProcessMemory
SetThreadContext
ResumeThread
TerminateProcess
CreateProcessW
GetThreadContext
ReadProcessMemory
VirtualQueryEx
GetTickCount
lstrcatA
WriteFile
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary

gdi32

GetStockObject

advapi32

OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenServiceA
ChangeServiceConfigA
StartServiceA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

msvcrt

strlen
??2@YAPAXI@Z
fread
ftell
fseek
fclose
fopen
memcpy
strstr
realloc
malloc
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
??1type_info@@UAE@XZ
strcat
strchr
_except_handler3
_strrev

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.MUTI
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

329471665f5c4c5f677765b61d503254

Headers

File Characteristics

Imports

kernel32

gdi32

advapi32

msvcrt

Sections

.text Size: 5KB - Virtual size: 4KB

.MUTI Size: 2KB - Virtual size: 1KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 2KB

.rsrc Size: 81KB - Virtual size: 80KB

.text
Size: 5KB - Virtual size: 4KB

.MUTI
Size: 2KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 81KB - Virtual size: 80KB