gh0strat | 60828b0a3aed7ff1459a1e074b09f0dc | Triage

Sharing

General

Target

60828b0a3aed7ff1459a1e074b09f0dc
Size

172KB
MD5

60828b0a3aed7ff1459a1e074b09f0dc
SHA1

1320999d1a87cc79239da25dbaf607e79f06ee8e
SHA256

4c746db20fe8d91ddd3e1402347b1e43a257d8db7ffa0c9061b891571d632ad2
SHA512

9fb481f68b00cb1b5794e9b721a41363df160ccfd248b7b6b68c7704829ff6aea6ad044e085c6f199441b95ca31049218e7eaf2b714e4fdb4ec10e9dc225a8a3
SSDEEP

3072:sX8gvoZhGH8RiRnvth6y47VFRg6rb1Zb/aQfZ6eiPeqovqw:sX8JZhmZ6yShltZbCVheqoi

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
60828b0a3aed7ff1459a1e074b09f0dc

Files

60828b0a3aed7ff1459a1e074b09f0dc
.exe windows:4 windows x86 arch:x86

77837203d9da0db97fcca524f441b8d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
SetFilePointer
lstrlenA
CloseHandle
FreeResource
DeleteFileA
SizeofResource
LockResource
FindResourceA
GetModuleFileNameA
GetEnvironmentVariableA
WaitForSingleObject
CreateEventA
MoveFileExA
ExitProcess
GetModuleHandleA
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
GetStartupInfoA
FreeLibrary

msvcrt

_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
exit
_exit
srand
rand
sprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
_XcptFilter

Sections

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 159KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE