gh0strat | 46ec523cbc3e0500e95fe56c7f4379ef | Triage

Sharing

General

Target

46ec523cbc3e0500e95fe56c7f4379ef
Size

151KB
MD5

46ec523cbc3e0500e95fe56c7f4379ef
SHA1

9ba163609216725c694a68fd03c6e855127801fc
SHA256

9b79ae4fc2a6864490deea288285d389126cc67f9fb2e7a8eec82c1dc8508a0c
SHA512

1a4bf147ecde08b58e3376df78e9a5977ef4e867cff1eff49239e2caae6ce5c15a0f2a6875f5e1dcb781476651345229fe42d0beb472825440e283d7ecc3a22f
SSDEEP

3072:bPJz5C9qblUloHkRz9Vg6cBLGKip8Fk6k47SUyC57EI:bPwoH+5IoK2Gjk42x2wI

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46ec523cbc3e0500e95fe56c7f4379ef

Files

46ec523cbc3e0500e95fe56c7f4379ef
.exe windows:4 windows x86 arch:x86

16e6c502bf4c3b967c7ad8ada94ce3f7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
FreeResource
Sleep
WriteFile
CreateFileA
DeleteFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
WaitForSingleObject
CreateEventA
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
GetTickCount
WinExec
GetModuleHandleA
GetLastError
RaiseException
GetStartupInfoA
InterlockedExchange
LocalAlloc
FreeLibrary

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__getmainargs
_acmdln
exit
_exit
srand
rand
sprintf
_XcptFilter

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ