gh0strat | 2dea81d1051e5b05ef31886a8934493b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2dea81d1051e5b05ef31886a8934493b
Size

134KB
MD5

2dea81d1051e5b05ef31886a8934493b
SHA1

5ffd00d74040ce8425eda935f0604bd1197ae77d
SHA256

e77c633d8d5b615f4b1c27edb107d62af6b4911b7882686864c31c9e05121c4d
SHA512

f00d3e7cf39195c9907fd4ebdcff796d95ce9637be5ca7855629443e0d58930faa4a5ce4d6712b92ed1ded683431863a9fc45db617cb0a79853606eea619d705
SSDEEP

3072:LBVASRH1lqfM4TYZesGO4Qg/0ilm37+BYfiA+SIML+HsZwUI:LBVASLlqfTY4Yjg/0VCY6hMLruD

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2dea81d1051e5b05ef31886a8934493b

Files

2dea81d1051e5b05ef31886a8934493b
.exe windows:4 windows x86 arch:x86

445f5b0aa537db7bba6e4fcfaac03b0f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetUnhandledExceptionFilter
Sleep
ReleaseMutex
CreateMutexA
GetCommandLineA
GetModuleFileNameA
CreateDirectoryA
GetCurrentThreadId
GetStartupInfoA
GetModuleHandleA
SetFilePointer
ReadFile
CloseHandle
GetSystemDirectoryA
lstrcatA
GetLastError
SetLastError
lstrcmpiA
GetProcAddress
lstrcpyA
CreateFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
WriteFile
lstrlenA
FreeResource
ExitProcess
LoadLibraryA
SetFileAttributesA

user32

GetInputState
GetMessageA
wsprintfA
PostThreadMessageA

advapi32

OpenServiceA
StartServiceA
RegQueryValueExA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegDeleteKeyA
RegCreateKeyExA
RegDeleteValueA

msvcrt

_XcptFilter
strtok
??2@YAPAXI@Z
strchr
_CxxThrowException
__CxxFrameHandler
realloc
malloc
_except_handler3
??3@YAXPAX@Z
strstr
??1type_info@@UAE@XZ
_exit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ