Behavioral task
behavioral1
Sample
e71e205f9c8d546b3440496e753092fb64b935d3a4527cfaee51edd516174755.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
e71e205f9c8d546b3440496e753092fb64b935d3a4527cfaee51edd516174755.exe
Resource
win10v2004-20231215-en
General
-
Target
e71e205f9c8d546b3440496e753092fb64b935d3a4527cfaee51edd516174755
-
Size
7.3MB
-
MD5
777753675a1edbfaa1023c2ad1cfe044
-
SHA1
eb0263e8965c89a3e39f72915ac6095979e83d4b
-
SHA256
e71e205f9c8d546b3440496e753092fb64b935d3a4527cfaee51edd516174755
-
SHA512
e7923a81df8e957d756bfecd1cf4d1f30471397b0876179ea0014f64665f2779cc2aa94a5349525688508d4c50ab4e8f58b210eefd3f58a421795e38f55fc4e1
-
SSDEEP
98304:sxfruKz0XLzCE0TEWcs5s7SMwzHZ6M1rM/e2l6yFyJfQa4s:azOCE0xZ6M1rGSfQ0
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
resource yara_rule sample cryptone -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e71e205f9c8d546b3440496e753092fb64b935d3a4527cfaee51edd516174755
Files
-
e71e205f9c8d546b3440496e753092fb64b935d3a4527cfaee51edd516174755.exe windows:4 windows x86 arch:x86
13e1c3269ca7b56cbbb1c9eb16ffd2e8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutWrite
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
mixerClose
mixerGetLineInfoA
mixerOpen
mixerGetDevCapsA
mixerGetNumDevs
mixerSetControlDetails
mixerGetControlDetailsA
mixerGetLineControlsA
waveOutPrepareHeader
waveOutOpen
waveOutGetNumDevs
PlaySoundA
waveOutClose
kernel32
IsBadReadPtr
IsBadCodePtr
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetConsoleCtrlHandler
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringW
LCMapStringA
FatalAppExitA
IsBadWritePtr
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetFileType
SetStdHandle
GetDriveTypeA
GetACP
TerminateProcess
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RaiseException
ExitThread
HeapReAlloc
RtlUnwind
HeapAlloc
HeapFree
GetCurrentDirectoryA
SetErrorMode
lstrcpyW
FindResourceExA
WaitForMultipleObjects
ReleaseMutex
CreateMutexA
ReleaseSemaphore
CreateSemaphoreA
VirtualProtect
GetProfileIntA
GetProfileStringA
GetCurrentProcessId
GetPrivateProfileSectionNamesA
EnumResourceLanguagesA
EnumResourceTypesA
GetExitCodeThread
GetDateFormatA
GetTimeFormatA
GetStringTypeW
HeapSize
CreateEventA
SetFileAttributesA
CloseHandle
TerminateThread
WaitForSingleObject
SystemTimeToFileTime
LocalFileTimeToFileTime
GetOEMCP
GetCPInfo
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
SetEvent
ResumeThread
CreateThread
Sleep
VirtualFree
VirtualAlloc
GetProcAddress
FreeResource
WriteFile
CreateFileA
DeleteFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
LoadLibraryA
lstrcpyA
OutputDebugStringA
SetFilePointer
ReadFile
lstrlenA
LocalFree
LocalAlloc
lstrcpynA
FindClose
FindNextFileA
FindFirstFileA
GetFileAttributesA
GetFileSize
RemoveDirectoryA
MoveFileA
GetLastError
CreateDirectoryA
CopyFileA
CreateProcessA
lstrcatA
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
GlobalFlags
SetLastError
GetDiskFreeSpaceA
GetFileTime
SetFileTime
GetTempFileNameA
SuspendThread
SetThreadPriority
GetCurrentThread
GetShortPathNameA
GetThreadLocale
GetStringTypeExA
GetFullPathNameA
GetVolumeInformationA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetCurrentProcess
DuplicateHandle
FormatMessageA
InterlockedIncrement
GetVersion
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenW
lstrcmpA
EnumResourceNamesA
BeginUpdateResourceA
UpdateResourceA
EndUpdateResourceA
LocalSize
GetCommandLineA
GetStartupInfoA
ExitProcess
GlobalSize
GetSystemDirectoryA
ResetEvent
MulDiv
GlobalFree
MultiByteToWideChar
WideCharToMultiByte
GetVersionExA
DeleteCriticalSection
CancelIo
InterlockedExchange
GetQueuedCompletionStatus
InterlockedDecrement
CreateIoCompletionPort
GetSystemInfo
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
PostQueuedCompletionStatus
InitializeCriticalSection
WritePrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetTickCount
GlobalAlloc
GlobalLock
GlobalUnlock
LoadLibraryExA
FreeLibrary
GetTempPathA
GetStringTypeA
user32
ReuseDDElParam
DestroyMenu
TranslateAcceleratorA
LoadAcceleratorsA
SetRectEmpty
MapDialogRect
SetWindowContextHelpId
ValidateRect
ShowOwnedPopups
PostQuitMessage
CharUpperA
wvsprintfA
OemToCharA
CharToOemA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
MapWindowPoints
PeekMessageA
SetFocus
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
ScrollWindow
GetScrollInfo
UnpackDDElParam
BringWindowToTop
DispatchMessageA
TranslateMessage
GetMessageA
RegisterWindowMessageA
LoadIconA
EnableWindow
SendMessageA
InvalidateRect
SetRect
SetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
IsChild
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenuItemID
TrackPopupMenu
SetWindowPlacement
CreateWindowExA
IsZoomed
LoadStringA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
GrayStringA
FindWindowA
IsRectEmpty
SetParent
GetClassNameA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
UpdateWindow
PostMessageA
GetCursorPos
PtInRect
GetSubMenu
LoadMenuA
GetWindowRect
ReleaseDC
GetDC
MessageBoxA
GetDialogBaseUnits
GetClientRect
GetWindow
SetCapture
LoadCursorA
SetCursor
ClientToScreen
ScreenToClient
WindowFromPoint
ReleaseCapture
IsWindowVisible
GetParent
WindowFromDC
GetWindowThreadProcessId
UnregisterClassA
MsgWaitForMultipleObjects
InSendMessage
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
DefFrameProcA
ExcludeUpdateRgn
DefDlgProcA
GetTabbedTextExtentA
GetClipboardFormatNameA
GetAsyncKeyState
CopyImage
RemoveMenu
GetSysColorBrush
CopyAcceleratorTableA
IntersectRect
IsIconic
GetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
IsWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
IsWindowEnabled
InsertMenuA
GetMenuStringA
CreateMenu
LoadBitmapA
SendDlgItemMessageA
DeleteMenu
SystemParametersInfoA
DrawTextA
ShowScrollBar
GetScrollBarInfo
DrawIconEx
GetKeyState
GetMenuState
GetWindowLongA
SetWindowLongA
CheckMenuRadioItem
SetClassLongA
ClipCursor
DestroyCursor
CopyRect
FillRect
LockWindowUpdate
GetFocus
DrawEdge
GetDoubleClickTime
IsWindowUnicode
GetWindowLongW
SetWindowLongW
SetCursorPos
UnionRect
GetWindowRgn
HideCaret
ShowCaret
IsMenu
LoadMenuIndirectA
GetMenuStringW
LookupIconIdFromDirectoryEx
GetMenuDefaultItem
IsClipboardFormatAvailable
GetMenuItemInfoA
SetWindowRgn
GetCursor
CopyIcon
CreateIconIndirect
GetIconInfo
DrawFrameControl
GetKeyboardLayoutList
GetKeyboardState
ToAsciiEx
GetKeyboardLayout
MapVirtualKeyExA
GetKeyNameTextA
IsCharLowerA
DrawAnimatedRects
EnumChildWindows
SetMenuDefaultItem
CreatePopupMenu
WaitMessage
GetNextDlgGroupItem
GetDCEx
InvertRect
SetForegroundWindow
ModifyMenuA
RedrawWindow
SetMenu
GetMenu
KillTimer
GetDesktopWindow
SetTimer
LoadImageA
DestroyIcon
GetSystemMenu
AppendMenuA
MessageBeep
RegisterClipboardFormatA
PostThreadMessageA
GetSysColor
MapVirtualKeyA
DrawFocusRect
DrawStateA
SendMessageTimeoutA
SetWindowPos
GetDlgCtrlID
wsprintfA
CheckMenuItem
EnableMenuItem
GetMenuItemCount
CharNextA
CreateIconFromResource
CreateIconFromResourceEx
LookupIconIdFromDirectory
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
InflateRect
OffsetRect
gdi32
DeleteDC
GdiFlush
DeleteObject
GetCharWidthA
StartDocA
SaveDC
RestoreDC
SelectPalette
SetPolyFillMode
SetROP2
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
OffsetClipRgn
LineTo
EndPage
SetTextJustification
SetTextCharacterExtra
SetMapperFlags
GetCurrentPositionEx
ArcTo
SetArcDirection
PolyDraw
PolylineTo
StretchBlt
PolyBezierTo
GetClipRgn
CreateRectRgn
SelectClipPath
ExtSelectClipRgn
PlayMetaFileRecord
GetObjectType
EnumMetaFile
PlayMetaFile
GetViewportExtEx
GetWindowExtEx
ExtCreatePen
CreateHatchBrush
CreatePatternBrush
CreateDIBPatternBrushPt
PtVisible
RectVisible
Escape
LPtoDP
DPtoLP
GetMapMode
SetRectRgn
CombineRgn
CreateFontIndirectA
CopyMetaFileA
CreateDCA
GetTextColor
GetBkColor
StartPage
SetAbortProc
DeleteMetaFile
CloseMetaFile
CreateMetaFileA
SetStretchBltMode
BitBlt
SetDIBColorTable
SelectObject
CreateCompatibleDC
CreateDIBSection
GetStockObject
GetPaletteEntries
CreateHalftonePalette
CreateSolidBrush
GetDeviceCaps
CreateCompatibleBitmap
StretchDIBits
ExtTextOutA
SetTextColor
SetBkColor
CreatePen
GetObjectA
CreateFontA
GetPixel
SetPixelV
GetTextExtentPoint32A
TextOutA
SetColorAdjustment
SetBkMode
GetDCOrgEx
GetClipBox
CreateBitmap
PatBlt
CreateRectRgnIndirect
SetTextAlign
MoveToEx
Polygon
GetWindowOrgEx
GetTextAlign
SetPixel
GetCurrentObject
GetDIBits
GetBitmapBits
ExtCreateRegion
EnumFontFamiliesExA
GetRgnBox
CreatePolygonRgn
RoundRect
PtInRegion
Rectangle
Polyline
GetViewportOrgEx
ExtFloodFill
Ellipse
SetBrushOrgEx
StrokePath
FillPath
StrokeAndFillPath
EndPath
CloseFigure
BeginPath
GetTextExtentPoint32W
ExtTextOutW
GetTextExtentPointA
CreateDIBitmap
AbortDoc
EndDoc
GetTextMetricsA
comdlg32
CommDlgExtendedError
PageSetupDlgA
PrintDlgA
ChooseColorA
GetSaveFileNameA
GetOpenFileNameA
GetFileTitleA
winspool.drv
DocumentPropertiesA
OpenPrinterA
ClosePrinter
advapi32
SetFileSecurityA
RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegEnumValueA
RegEnumKeyExA
RegEnumKeyA
RegCreateKeyA
RegSetValueA
GetFileSecurityA
RegCloseKey
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
shell32
SHBrowseForFolderA
Shell_NotifyIconA
SHGetPathFromIDListA
SHGetFileInfoA
SHGetSpecialFolderLocation
DragQueryFileA
ShellExecuteA
SHGetMalloc
DragFinish
DragAcceptFiles
SHAppBarMessage
ExtractIconA
comctl32
CreatePropertySheetPageA
ImageList_Write
ImageList_Read
ImageList_Merge
ImageList_LoadImageA
ImageList_Create
ImageList_Destroy
ord14
ord13
ord17
ImageList_AddMasked
ImageList_SetBkColor
ImageList_ReplaceIcon
PropertySheetA
ImageList_Remove
ImageList_Draw
ImageList_GetImageInfo
ImageList_Add
ImageList_DrawEx
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_GetIcon
_TrackMouseEvent
DestroyPropertySheetPage
oledlg
ord4
ord9
ord5
ord6
ord7
ord3
ord1
ord8
ole32
OleGetClipboard
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
CoDisconnectObject
OleDuplicateData
CoTaskMemAlloc
CreateBindCtx
SetConvertStg
WriteFmtUserTypeStg
WriteClassStg
OleRegGetUserType
ReadFmtUserTypeStg
ReadClassStg
StringFromCLSID
CoTreatAsClass
ReleaseStgMedium
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleRun
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRegisterClassObject
CoRevokeClassObject
OleSetClipboard
OleIsCurrentClipboard
OleFlushClipboard
GetRunningObjectTable
IsAccelerator
OleTranslateAccelerator
CreateDataAdviseHolder
OleRegGetMiscStatus
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
CoTaskMemFree
CreateFileMoniker
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
OleLockRunning
OleSetContainedObject
OleCreateFromData
OleCreateLinkFromData
OleCreateStaticFromData
OleCreateFromFile
OleCreateLinkToFile
OleCreate
OleLoad
OleSave
GetHGlobalFromILockBytes
OleGetIconOfClass
WriteClassStm
OleSaveToStream
CreateItemMoniker
CreateGenericComposite
OleQueryCreateFromData
OleQueryLinkFromData
OleIsRunning
OleSetMenuDescriptor
GetClassFile
DoDragDrop
CoGetMalloc
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleRegEnumVerbs
CreateOleAdviseHolder
olepro32
ord253
ord251
oleaut32
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantClear
SafeArrayRedim
VariantCopy
SysAllocString
SysAllocStringByteLen
VariantChangeType
SysStringByteLen
VarCyFromStr
VarBstrFromCy
VarDateFromStr
VarBstrFromDate
SafeArrayCopy
SafeArrayAllocData
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayLock
SafeArrayUnlock
SafeArrayDestroy
SafeArrayDestroyData
SafeArrayDestroyDescriptor
SysFreeString
SysAllocStringLen
VariantTimeToSystemTime
SysReAllocStringLen
SafeArrayCreateVector
SysStringLen
LoadTypeLi
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayAllocDescriptor
OleLoadPicturePath
VariantChangeTypeEx
GetErrorInfo
SetErrorInfo
CreateErrorInfo
VariantInit
urlmon
URLDownloadToFileA
ws2_32
closesocket
getpeername
inet_ntoa
shutdown
getsockname
ntohs
WSAIoctl
WSACloseEvent
setsockopt
gethostbyname
WSARecv
accept
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSASocketA
WSAGetLastError
WSACreateEvent
WSAEventSelect
bind
gethostname
select
listen
WSACleanup
WSASend
inet_addr
send
recv
WSAStartup
htons
socket
ioctlsocket
connect
shlwapi
PathRemoveFileSpecA
SHAutoComplete
avifil32
AVIFileExit
AVIStreamSetFormat
AVIFileCreateStreamA
AVIFileOpenA
AVIStreamWrite
AVIFileRelease
AVIFileInit
AVIStreamRelease
msvfw32
DrawDibDraw
DrawDibOpen
DrawDibClose
skinh
SkinH_Detach
SkinH_SetAero
SkinH_AttachRes
wininet
FtpPutFileA
FtpGetFileA
GopherCreateLocatorA
GopherGetAttributeA
GopherOpenFileA
HttpOpenRequestA
InternetErrorDlg
HttpAddRequestHeadersA
HttpSendRequestA
HttpEndRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpFindFirstFileA
InternetFindNextFileA
GopherFindFirstFileA
InternetGetLastResponseInfoA
FtpOpenFileA
FtpGetCurrentDirectoryA
FtpSetCurrentDirectoryA
FtpRemoveDirectoryA
FtpCreateDirectoryA
FtpRenameFileA
FtpDeleteFileA
InternetConnectA
InternetQueryDataAvailable
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetGetCookieA
InternetSetCookieA
InternetSetStatusCallback
InternetSetOptionExA
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
imm32
ImmAssociateContext
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rodata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rotext Size: 112KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 488KB - Virtual size: 484KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1.8MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ