gh0strat | 184134d96a333009b7f88a8f305abfb5

Sharing

Copy URL Twitter E-mail

General

Target

184134d96a333009b7f88a8f305abfb5
Size

119KB
MD5

184134d96a333009b7f88a8f305abfb5
SHA1

49e5423301a685bd05b41fcfd84e2f08783cae2e
SHA256

01fffb3f4e8e21fa0298804c0e255d69170a60a16e52a50a342fa6740dd78c18
SHA512

c565639fbe37c155ac0061105085668282a764fb2d9f7d5cf73eb5a36635897a8691ad3badab46451b117e15cc466247ecf6dea614b5e5e81a6540a7f3b29e30
SSDEEP

3072:U20aRanvV0zrf5R/h6LEeVNAt3Xp8oTjYR4TJ2TJw:UlaRavVe/hUBP+58onLTJ2TJw

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

184134d96a333009b7f88a8f305abfb5
.exe windows:4 windows x86 arch:x86

239950ab533e5a0c5fb30120f8ec54dc

Code Sign

2c:c6:c7:4e:a2:b4:f8:f2:d1:d7:fc:c7:fa:cd:16:3f:9c:7b:08:76
Signer

Actual PE Digest

2c:c6:c7:4e:a2:b4:f8:f2:d1:d7:fc:c7:fa:cd:16:3f:9c:7b:08:76

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
_mbsstr
__CxxFrameHandler

kernel32

GetProcAddress
GetStartupInfoW
GetModuleHandleW
SetUnhandledExceptionFilter
lstrlenA
GetFileAttributesA
GetTempPathA
lstrcatA
FindResourceA
LoadResource
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SizeofResource
SetFileAttributesA
ExitProcess
OutputDebugStringA
LoadLibraryA
GetModuleHandleA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 336B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 960B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 816B - Virtual size: 804B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 736B - Virtual size: 726B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

239950ab533e5a0c5fb30120f8ec54dc

Code Sign

2c:c6:c7:4e:a2:b4:f8:f2:d1:d7:fc:c7:fa:cd:16:3f:9c:7b:08:76Signer

Headers

File Characteristics

Imports

msvcrt

kernel32

Sections

.text Size: 3KB - Virtual size: 3KB

.rdata Size: 336B - Virtual size: 336B

.data Size: 960B - Virtual size: 960B

INIT Size: 816B - Virtual size: 804B

.rsrc Size: 108KB - Virtual size: 108KB

.reloc Size: 736B - Virtual size: 726B

2c:c6:c7:4e:a2:b4:f8:f2:d1:d7:fc:c7:fa:cd:16:3f:9c:7b:08:76
Signer

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 336B - Virtual size: 336B

.data
Size: 960B - Virtual size: 960B

INIT
Size: 816B - Virtual size: 804B

.rsrc
Size: 108KB - Virtual size: 108KB

.reloc
Size: 736B - Virtual size: 726B