gh0strat | 9d60f0a0b39902f386e62dbcb10faba8[.]exe | Triage

Sharing

General

Target

9d60f0a0b39902f386e62dbcb10faba8.exe
Size

50KB
MD5

9d60f0a0b39902f386e62dbcb10faba8
SHA1

0fbbaa369d3239724c43851d017e7869275d3627
SHA256

f82bedc6bc993c19eb51bca41798f4cf546f75e5071469d6e3f9f9322316eaa8
SHA512

21ae0d51c437805b764b392caef276fdd663bd018e7851aaf65231b1acfe21d956a1dcd1d5c76c7f00bb32ce3a01fd6367a3107cfb82c05bb88ec1368d707d51
SSDEEP

768:LH7EHcGCUSJcG1xPhNaAoJ/a/5wUStN1ijVtDi12oC+FGUiaU4YBm:fjGreNaP1a/5AtN1iZt02lsFlum

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9d60f0a0b39902f386e62dbcb10faba8.exe

Files

9d60f0a0b39902f386e62dbcb10faba8.exe
.exe windows:4 windows x86 arch:x86

7ebe15c5f433bdbc0f6ba65218a5270a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
WinExec
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
GetModuleHandleA

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__getmainargs
__p__fmode
__set_app_type
_except_handler3
_controlfp
_acmdln
exit
_XcptFilter
_exit
srand
rand
sprintf
__p__commode

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ