gh0strat | a670e06370d6e5fd680b8b9ef6367021[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
a670e06370d6e5fd680b8b9ef6367021.exe
Size 202KB
Sample240107-yb1qmacfhp
SHA256 02ec221529ac40438f1299bdc31672c16f242fcfbf61c35ff1e53b25608c8d15
MD5 a670e06370d6e5fd680b8b9ef6367021
SHA1 b0cfe6e7117a37cbd71c6d53ad1e823701f5d5da
SHA512 9acca61359d55ed858c03bf4b3352e19c3d0cfd299b521523222c985242d9efb5a0eb15733c30b3735d459f0b30fbd0330818cd5b6abbc43aa046a5ee5049872
SSDEEP 3072:EAxxClZbgMiXyxezdcNj12JIHdAht0ukLFyBkIA9WuqqDbyWTBft4MzNtOZ:EkDMVQfJXtV0RIkWuqqDuWTBl4QOZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a670e06370d6e5fd680b8b9ef6367021.exe

File Explorer

a670e06370d6e5fd680b8b9ef6367021.exe

.exe 202KB

a670e06370d6e5fd680b8b9ef6367021.exe

IMPHASH c764fb7eb995b160b03f3b3eadd63f47
SHA256 02ec221529ac40438f1299bdc31672c16f242fcfbf61c35ff1e53b25608c8d15
MD5 a670e06370d6e5fd680b8b9ef6367021
SHA1 b0cfe6e7117a37cbd71c6d53ad1e823701f5d5da
SHA512 9acca61359d55ed858c03bf4b3352e19c3d0cfd299b521523222c985242d9efb5a0eb15733c30b3735d459f0b30fbd0330818cd5b6abbc43aa046a5ee5049872
SSDEEP 3072:EAxxClZbgMiXyxezdcNj12JIHdAht0ukLFyBkIA9WuqqDbyWTBft4MzNtOZ:EkDMVQfJXtV0RIkWuqqDuWTBl4QOZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

85908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenProcess GetProcAddress LoadLibraryW HeapFree VirtualFree VirtualAlloc GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetSystemDirectoryA DeviceIoControl GetModuleHandleW GetSystemInfo GetVersionExA GetModuleFileNameA OpenEventW SetErrorMode GetComputerNameA CreateMutexW ExitProcess GetCurrentThreadId ExpandEnvironmentStringsA GetStartupInfoA CreatePipe DisconnectNamedPipe TerminateProcess WaitForMultipleObjects PeekNamedPipe GetTempPathA LeaveCriticalSection EnterCriticalSection SetCurrentDirectoryA InitializeCriticalSection GetWindowsDirectoryA FileTimeToSystemTime GetCurrentDirectoryA SetEndOfFile lstrcpyW MoveFileExA DeleteCriticalSection VirtualProtect FreeLibrary LoadLibraryA SystemTimeToTzSpecificLocalTime GetCurrentProcess GetModuleHandleA Process32Next Process32First CreateToolhelp32Snapshot MultiByteToWideChar WideCharToMultiByte LocalSize MoveFileA WriteFile SetFilePointer ReadFile CreateFileA GetFileSize RemoveDirectoryA LocalAlloc FindFirstFileA LocalReAlloc FindNextFileA LocalFree FindClose GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA CreateProcessA GetFileAttributesA CreateDirectoryA GetLastError DeleteFileA GetProcessHeap HeapAlloc GetCurrentProcessId GetLocalTime GetTickCount CancelIo InterlockedExchange lstrcpyA ResetEvent lstrlenA lstrcatA CreateThread ResumeThread Sleep SetEvent WaitForSingleObject TerminateThread LCMapStringW LCMapStringA FlushFileBuffers SetStdHandle GetStringTypeW GetStringTypeA IsBadCodePtr IsBadReadPtr GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetOEMCP GetACP GetCPInfo InterlockedIncrement InterlockedDecrement HeapSize IsBadWritePtr HeapCreate HeapDestroy GetEnvironmentVariableA SetUnhandledExceptionFilter TlsGetValue SetLastError TlsAlloc TlsSetValue GetVersion GetCommandLineA HeapReAlloc RaiseException RtlUnwind CloseHandle lstrcmpiA CreateEventW

advapi32

RegCreateKeyA RegQueryValueExA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges OpenEventLogA ClearEventLogA CloseEventLog StartServiceA LockServiceDatabase ChangeServiceConfigA UnlockServiceDatabase QueryServiceStatus ControlService DeleteService OpenSCManagerW EnumServicesStatusA OpenServiceA QueryServiceConfigA CloseServiceHandle RegCloseKey RegEnumValueA RegQueryInfoKeyA RegCreateKeyExA RegSetValueExA RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegQueryValueA RegOpenKeyExA

user32

GetMessageA SendMessageA GetUserObjectInformationA SetDlgItemTextA GetDlgItemTextA SetWindowPos ShowWindow UpdateWindow CreateDialogParamA GetDlgItem wsprintfA CharNextA LoadCursorA BlockInput SystemParametersInfoA keybd_event MapVirtualKeyA SetCapture WindowFromPoint SetCursorPos mouse_event CloseClipboard SetClipboardData EmptyClipboard TranslateMessage CreateWindowExA DispatchMessageA IsWindow CloseWindow OpenDesktopA EndDialog GetThreadDesktop OpenInputDesktop SetThreadDesktop CloseDesktop ExitWindowsEx FindWindowW GetClassNameA GetWindowTextA IsWindowVisible GetWindowThreadProcessId GetWindow MessageBoxW GetInputState PostThreadMessageA wsprintfW GetCursorInfo GetCursorPos ReleaseDC GetDesktopWindow GetDC SetRect GetSystemMetrics GetClipboardData OpenClipboard DestroyCursor

ole32

CoUninitialize CoCreateInstance CoInitializeEx

shell32

SHGetFileInfoA ShellExecuteA

setupapi

SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyA SetupDiDestroyDeviceInfoList

avicap32

capGetDriverDescriptionA capCreateCaptureWindowW

msvfw32

ICSeqCompressFrameStart ICSeqCompressFrameEnd ICSeqCompressFrame ICClose ICOpen ICSendMessage ICCompressorFree

shlwapi

SHDeleteKeyA PathRemoveFileSpecA

winmm

waveOutGetNumDevs waveOutOpen waveOutPrepareHeader waveInGetNumDevs waveInOpen waveInPrepareHeader waveInAddBuffer waveOutWrite waveInStop waveInReset waveInUnprepareHeader waveInClose waveOutReset waveOutUnprepareHeader waveOutClose waveInStart

wininet

InternetReadFile InternetOpenW InternetOpenUrlA InternetCloseHandle

netapi32

NetUserEnum NetUserAdd NetUserDel NetLocalGroupAddMembers NetApiBufferFree

psapi

GetModuleFileNameExA EnumProcessModules