gh0strat | 3960535be3dc3f912eff80829aa36f1b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3960535be3dc3f912eff80829aa36f1b
Size

146KB
MD5

3960535be3dc3f912eff80829aa36f1b
SHA1

0a1d7319e261a24913bc7defb40857ec21604948
SHA256

6f475a9a31e0494aac56500f19f7dc108adca0d1ce88d30add7b994fbb79f55d
SHA512

46afe8a64ad00ce3fc9ea5747b10076f9d8cd476683055703c1fc6b772c9a0c2c84738827eefab3e88d9cd112187b59f9ab61b782f9b985113428815f807a905
SSDEEP

3072:56N036cbz5ANmal51fxAb5HwR1UiOQ4lJr88ceqovQ:56N036cCNJzVxo6UJ3r8zeqo

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3960535be3dc3f912eff80829aa36f1b

Files

3960535be3dc3f912eff80829aa36f1b
.exe windows:4 windows x86 arch:x86

65dc1a18cfce59fede3bb8f778c5f47e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
WaitForSingleObject
FindResourceA
GetWindowsDirectoryA
LoadResource
LoadLibraryA
GetProcAddress
CreateFileA
WriteFile
Sleep
FreeResource
lstrlenA
CloseHandle
GetModuleHandleA
GetStartupInfoA

advapi32

OpenServiceA
ChangeServiceConfigA
ControlService
StartServiceA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
OpenSCManagerA

msvcrt

rand
srand
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strlen
sprintf

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 142KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ