gh0strat | 214e240d0e0cad96d75df5fbe78a341e

Sharing

Copy URL Twitter E-mail

General

Target

214e240d0e0cad96d75df5fbe78a341e
Size

128KB
MD5

214e240d0e0cad96d75df5fbe78a341e
SHA1

a711f52f9b6080adab199dec306e5baf3d105ec1
SHA256

e1025ad1098af06e5d0b451df5f9e7a7d2db870d32488bd17d54d772863e623c
SHA512

195df29d7b378e63cdaec2c62ad821195fc5309beaa31cd10fa85b617bc1c5bf38832b6d6d8b947ed73314b78d42a796c02822a3192ed0175c92f199490a3c00
SSDEEP

3072:He56ybPMyhCnXfFXshG5a+q0Y6VKFg8sidf11UxSTxpDsLnb:He56ybPMyhCv5mG5a+5wglO1Ug9pg

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

214e240d0e0cad96d75df5fbe78a341e
.exe windows:4 windows x86 arch:x86

189334fab1e46b0caa4d68522b473312

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:3b:f8:85:49:64:12:20:7e:cb:70:ac:fa:c6:75:5b
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

24/11/2006, 00:00

Not After

23/11/2008, 23:59

Subject

CN=Qizhi Software (beijing) Co. Ltd,OU=Secure Application Development,O=Qizhi Software (beijing) Co. Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
SetUnhandledExceptionFilter
Sleep
ReleaseMutex
CreateMutexA
Process32First
CreateDirectoryA
GetCurrentThreadId
GetStartupInfoA
GetModuleHandleA
Process32Next
GetModuleFileNameA
SetFilePointer
ReadFile
lstrcmpA
DeleteFileA
GetFileAttributesA
SetLastError
lstrcmpiA
lstrcpyA
LoadResource
SetFileTime
SizeofResource
lstrlenA
GetProcAddress
CloseHandle
MultiByteToWideChar
ExitProcess
lstrcatA
GetLastError
GetTempPathA
GetWindowsDirectoryA
FreeLibrary
LoadLibraryA
GetCommandLineA

user32

GetMessageA
wsprintfA
PostThreadMessageA
GetInputState

advapi32

LookupAccountNameA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetFileSecurityA
StartServiceA
OpenServiceA
CloseServiceHandle

shell32

ShellExecuteA

msvcrt

_acmdln
_strnset
_except_handler3
realloc
malloc
strchr
strtok
??2@YAPAXI@Z
_CxxThrowException
__CxxFrameHandler
??3@YAXPAX@Z
strstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_stricmp
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

netapi32

NetUserGetLocalGroups
NetApiBufferFree

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fangqi
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

189334fab1e46b0caa4d68522b473312

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

61:3b:f8:85:49:64:12:20:7e:cb:70:ac:fa:c6:75:5bCertificate

Extended Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcrt

netapi32

Sections

.text Size: 12KB - Virtual size: 11KB

.rsrc Size: 109KB - Virtual size: 108KB

.fangqi Size: 512B - Virtual size: 512B

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

61:3b:f8:85:49:64:12:20:7e:cb:70:ac:fa:c6:75:5b
Certificate

.text
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 109KB - Virtual size: 108KB

.fangqi
Size: 512B - Virtual size: 512B