gh0strat | 6911fc02b7773d39bc8f9b26e2c31343

General

Target

6911fc02b7773d39bc8f9b26e2c31343
Size

192KB
MD5

6911fc02b7773d39bc8f9b26e2c31343
SHA1

8c587ea37cbdd44a62c0711db1b946fdbc89ae9b
SHA256

d3ab9b934b89b450c83f13cd3ce81f1b53605ce2e2859012e9fdb5c9d75a9242
SHA512

d34f16d8b6e84390ab4c103fd3a633d47a7b03b1c3e4aeb20467eebc13286b3e54e0dab3fef3019ca1473e01a863d70ba8f74e3bffafff0e5b128ffaf971fcbc
SSDEEP

3072:i7hKhtKxoSpeHGSHFF37CrJLJKir93sYYAzClzJGatlHCM:iVwJLHur5vrN3YAzkzJGatNX

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6911fc02b7773d39bc8f9b26e2c31343

Files

6911fc02b7773d39bc8f9b26e2c31343
.exe windows:4 windows x86 arch:x86

fdabf3445de4fe6d3b50f8645b99db85

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
lstrlenA
WriteFile
SetFilePointer
CreateFileA
FreeResource
GetLocalTime
GetTickCount
SizeofResource
LoadResource
FindResourceA
ExitProcess
WinExec
lstrcatA
lstrcpyA
GetModuleFileNameA
CopyFileA
MoveFileExA
RemoveDirectoryA
DeleteFileA
CreateThread
GetLastError
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
CreateDirectoryA
GetCommandLineA
GetVersion
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
VirtualAlloc
HeapReAlloc

user32

wsprintfA
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 156KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fdabf3445de4fe6d3b50f8645b99db85

Headers

File Characteristics

Imports

kernel32

user32

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 11KB

.rsrc Size: 156KB - Virtual size: 154KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 156KB - Virtual size: 154KB